Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
prank.exe

Overview

General Information

Sample name:prank.exe
Analysis ID:1423651
MD5:8611679797f3e3c3778ae0831b38a4c0
SHA1:2943bda7716f5f19f7c952413f263c31ee56604a
SHA256:71dbbbeb418305a7a16464a0558113d8d1227ce3f16d22dfc9d902a18b9eb8a6
Tags:exe
Infos:

Detection

Discord Token Stealer
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected Discord Token Stealer
Contains functionality to infect the boot sector
Found pyInstaller with non standard icon
Tries to harvest and steal browser information (history, passwords, etc)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • prank.exe (PID: 7360 cmdline: "C:\Users\user\Desktop\prank.exe" MD5: 8611679797F3E3C3778AE0831B38A4C0)
    • conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • prank.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\prank.exe" MD5: 8611679797F3E3C3778AE0831B38A4C0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: prank.exe PID: 7456JoeSecurity_DiscordTokenStealerYara detected Discord Token StealerJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Antivirus / Scanner detection for submitted sample
    Source: prank.exeAvira: detected
    Antivirus detection for URL or domain
    Source: https://xvirus.lolAvira URL Cloud: Label: malware
    Multi AV Scanner detection for submitted file
    Source: prank.exeReversingLabs: Detection: 66%
    Source: prank.exeVirustotal: Detection: 57%Perma Link
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E8193D
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECF9B0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9ECF9B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E811C2 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memmove,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E811C2
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E81023
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE3940 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,2_2_00007FFDF9EE3940
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81EE2 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E81EE2
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8D8AF CRYPTO_free,2_2_00007FFDF9E8D8AF
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,2_2_00007FFDF9E81997
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC98B0 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,2_2_00007FFDF9EC98B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EED890 CRYPTO_malloc,ERR_new,ERR_set_debug,memmove,2_2_00007FFDF9EED890
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECD870 RAND_bytes_ex,CRYPTO_malloc,memset,2_2_00007FFDF9ECD870
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,2_2_00007FFDF9E81087
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82536 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E82536
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EDFB70 CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9EDFB70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC3B40 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EC3B40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EB3B00 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EB3B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8FB00 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,2_2_00007FFDF9E8FB00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E812D0 CRYPTO_THREAD_run_once,2_2_00007FFDF9E812D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E91AA0 CRYPTO_free,CRYPTO_strndup,2_2_00007FFDF9E91AA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E85E4A BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,2_2_00007FFDF9E85E4A
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,memmove,2_2_00007FFDF9E8144C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E825A4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,2_2_00007FFDF9E825A4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,memmove,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memmove,ERR_new,memmove,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E81ACD
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E81B31
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EDFE00 CRYPTO_free,CRYPTO_strndup,2_2_00007FFDF9EDFE00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA5DF0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9EA5DF0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E811E0 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,2_2_00007FFDF9E811E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_new,2_2_00007FFDF9E81B18
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EADDD0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,2_2_00007FFDF9EADDD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE3DC0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,2_2_00007FFDF9EE3DC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8FDB0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,2_2_00007FFDF9E8FDB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E819E7 CRYPTO_free,2_2_00007FFDF9E819E7
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,2_2_00007FFDF9E8176C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E99D50 CRYPTO_free,CRYPTO_strdup,2_2_00007FFDF9E99D50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE9D40 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9EE9D40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8157D CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,2_2_00007FFDF9E8157D
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E97CB0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,2_2_00007FFDF9E97CB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED7C90 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9ED7C90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8108C ERR_new,ERR_set_debug,CRYPTO_free,2_2_00007FFDF9E8108C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E825EF CRYPTO_malloc,ERR_new,ERR_set_debug,memmove,ERR_new,ERR_set_debug,2_2_00007FFDF9E825EF
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF6040 CRYPTO_memcmp,2_2_00007FFDF9EF6040
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE6030 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,2_2_00007FFDF9EE6030
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8107D CRYPTO_free,2_2_00007FFDF9E8107D
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81C58 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,2_2_00007FFDF9E81C58
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82400 CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E82400
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E95FD0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,2_2_00007FFDF9E95FD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81D8E CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9E81D8E
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E813D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,2_2_00007FFDF9E813D9
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA5FA0 CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EA5FA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED7F60 CRYPTO_free,CRYPTO_free,2_2_00007FFDF9ED7F60
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E97F00 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,2_2_00007FFDF9E97F00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E83EE0 CRYPTO_free,2_2_00007FFDF9E83EE0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE1240 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9EE1240
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EFB230 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9EFB230
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EAF200 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memmove,2_2_00007FFDF9EAF200
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF31E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,2_2_00007FFDF9EF31E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED71C0 CRYPTO_realloc,2_2_00007FFDF9ED71C0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8214E EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,2_2_00007FFDF9E8214E
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC3180 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,2_2_00007FFDF9EC3180
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81F91 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,2_2_00007FFDF9E81F91
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E820EF CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E820EF
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E9F100 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,2_2_00007FFDF9E9F100
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81181 _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,2_2_00007FFDF9E81181
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82478 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E82478
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EB9430 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9EB9430
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED73F0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9ED73F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E821B7 CRYPTO_free,2_2_00007FFDF9E821B7
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EAD3B0 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,2_2_00007FFDF9EAD3B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8D390 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,2_2_00007FFDF9E8D390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E81A41
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E813DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E813DE
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,2_2_00007FFDF9E8105F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED1370 CRYPTO_memcmp,2_2_00007FFDF9ED1370
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EEB350 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EEB350
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81E6F ERR_new,ERR_set_debug,CRYPTO_clear_free,2_2_00007FFDF9E81E6F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E811AE EVP_MAC_CTX_free,CRYPTO_free,2_2_00007FFDF9E811AE
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF530B CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9EF530B
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,2_2_00007FFDF9E81A23
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EB52C8 EVP_MAC_CTX_free,CRYPTO_free,2_2_00007FFDF9EB52C8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E821F8 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memmove,ERR_new,ERR_set_debug,2_2_00007FFDF9E821F8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA9284 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,2_2_00007FFDF9EA9284
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82121 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,2_2_00007FFDF9E82121
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE1636 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,2_2_00007FFDF9EE1636
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8F620 CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9E8F620
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED15E0 CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9ED15E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,2_2_00007FFDF9E81654
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81D02 CRYPTO_zalloc,CRYPTO_zalloc,2_2_00007FFDF9E81D02
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,2_2_00007FFDF9E81677
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,2_2_00007FFDF9E81B90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,2_2_00007FFDF9E8195B
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82388 CRYPTO_free,2_2_00007FFDF9E82388
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE3480 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,2_2_00007FFDF9EE3480
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81846 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,2_2_00007FFDF9E81846
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC5800 CRYPTO_free,2_2_00007FFDF9EC5800
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,2_2_00007FFDF9E81992
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED1800 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,2_2_00007FFDF9ED1800
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8B7C0 CRYPTO_clear_free,2_2_00007FFDF9E8B7C0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E820FE CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E820FE
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8231F ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,2_2_00007FFDF9E8231F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81555 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,2_2_00007FFDF9E81555
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82130 memmove,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E82130
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EEB760 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EEB760
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EAD740 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,2_2_00007FFDF9EAD740
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81122 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memmove,CRYPTO_malloc,memmove,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memmove,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,2_2_00007FFDF9E81122
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE3730 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,2_2_00007FFDF9EE3730
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E81483
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8D710 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E8D710
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81267 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,2_2_00007FFDF9E81267
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81398 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memmove,2_2_00007FFDF9E81398
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82608 CRYPTO_malloc,ERR_new,ERR_set_debug,memmove,memmove,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,2_2_00007FFDF9E82608
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81F2D ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,2_2_00007FFDF9E81F2D
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82383 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E82383
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EFA9D0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9EFA9D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E81A0F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E94960 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,2_2_00007FFDF9E94960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E81401
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E823EC EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,2_2_00007FFDF9E823EC
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA0880 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,2_2_00007FFDF9EA0880
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED8860 CRYPTO_free,CRYPTO_strndup,2_2_00007FFDF9ED8860
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE6C40 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,2_2_00007FFDF9EE6C40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC8C20 OPENSSL_cleanse,CRYPTO_free,2_2_00007FFDF9EC8C20
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE0C10 ERR_new,ERR_set_debug,CRYPTO_clear_free,2_2_00007FFDF9EE0C10
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E84C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E84C00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81212 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,2_2_00007FFDF9E81212
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E814CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E814CE
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E81492
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E826C6 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,2_2_00007FFDF9E826C6
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E9ABB0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,2_2_00007FFDF9E9ABB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81154 CRYPTO_free,ERR_new,ERR_set_debug,2_2_00007FFDF9E81154
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC8B70 CRYPTO_free,2_2_00007FFDF9EC8B70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E84B40 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E84B40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC2B40 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,2_2_00007FFDF9EC2B40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82432 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E82432
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECEB20 CRYPTO_free,2_2_00007FFDF9ECEB20
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E813A2 memmove,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,2_2_00007FFDF9E813A2
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECEAC0 CRYPTO_free,2_2_00007FFDF9ECEAC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF2A70 CRYPTO_memcmp,2_2_00007FFDF9EF2A70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E88A60 CRYPTO_zalloc,CRYPTO_free,2_2_00007FFDF9E88A60
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE4A60 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9EE4A60
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E9EE4A CRYPTO_free,2_2_00007FFDF9E9EE4A
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E817F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E817F8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E822E8 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E822E8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8258B ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,OPENSSL_cleanse,2_2_00007FFDF9E8258B
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF2DF0 CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9EF2DF0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E94DB0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E94DB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EFAD80 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,2_2_00007FFDF9EFAD80
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC8D60 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,2_2_00007FFDF9EC8D60
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E94D50 CRYPTO_get_ex_new_index,2_2_00007FFDF9E94D50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E817DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E817DF
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81CA8 CRYPTO_strdup,CRYPTO_free,2_2_00007FFDF9E81CA8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EAECA0 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,2_2_00007FFDF9EAECA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81771 CRYPTO_free,2_2_00007FFDF9E81771
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E817E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E817E9
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E9D040 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E9D040
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF3010 CRYPTO_free,CRYPTO_strndup,2_2_00007FFDF9EF3010
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81113 EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,2_2_00007FFDF9E81113
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E84FE0 CRYPTO_free,2_2_00007FFDF9E84FE0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC8FD0 CRYPTO_malloc,ERR_new,ERR_set_debug,2_2_00007FFDF9EC8FD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82379 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memmove,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E82379
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EEAFB0 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,2_2_00007FFDF9EEAFB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,2_2_00007FFDF9E81A32
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,2_2_00007FFDF9E81460
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81186 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9E81186
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,2_2_00007FFDF9E81811
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,memmove,_time64,X509_free,memmove,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,2_2_00007FFDF9E81A05
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81370 ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E81370
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EFA250 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,2_2_00007FFDF9EFA250
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE4250 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,2_2_00007FFDF9EE4250
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E819DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,2_2_00007FFDF9E819DD
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E86233 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,2_2_00007FFDF9E86233
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EEC220 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memmove,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EEC220
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81F41 CRYPTO_malloc,ERR_new,ERR_set_debug,2_2_00007FFDF9E81F41
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED81E0 CRYPTO_memcmp,2_2_00007FFDF9ED81E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81CF3 CRYPTO_malloc,memset,memmove,memmove,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,2_2_00007FFDF9E81CF3
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E84130 CRYPTO_free,2_2_00007FFDF9E84130
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8150A OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,2_2_00007FFDF9E8150A
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82694 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,2_2_00007FFDF9E82694
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E940F0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,2_2_00007FFDF9E940F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECE0E0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9ECE0E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E960B0 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,2_2_00007FFDF9E960B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82734 CRYPTO_free,CRYPTO_strdup,2_2_00007FFDF9E82734
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA6090 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9EA6090
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECE070 CRYPTO_free,2_2_00007FFDF9ECE070
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E815E1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memmove,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memmove,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E815E1
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E816A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E816A4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E824FA CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E824FA
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E9C3A0 CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9E9C3A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81F5A CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,2_2_00007FFDF9E81F5A
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA2370 memmove,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,2_2_00007FFDF9EA2370
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E84330 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E84330
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81627 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,2_2_00007FFDF9E81627
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF8300 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,2_2_00007FFDF9EF8300
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E962F0 CRYPTO_THREAD_run_once,2_2_00007FFDF9E962F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81366 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,2_2_00007FFDF9E81366
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA62A0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memmove,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9EA62A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8138E CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E8138E
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E823FB CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9E823FB
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECE641 CRYPTO_free,CRYPTO_free,2_2_00007FFDF9ECE641
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EE4630 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,2_2_00007FFDF9EE4630
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,2_2_00007FFDF9E81893
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,2_2_00007FFDF9E81AC3
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECE5C0 CRYPTO_free,2_2_00007FFDF9ECE5C0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E81AB4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ED85B0 CRYPTO_free,CRYPTO_memdup,2_2_00007FFDF9ED85B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E81488
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8E592 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,2_2_00007FFDF9E8E592
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8103C CRYPTO_malloc,COMP_expand_block,2_2_00007FFDF9E8103C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EAE500 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,2_2_00007FFDF9EAE500
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82036 CRYPTO_free,2_2_00007FFDF9E82036
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81D98 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memmove,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,2_2_00007FFDF9E81D98
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E818B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9E818B6
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8E4A0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E8E4A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82059 CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E82059
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81EE7 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memmove,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,2_2_00007FFDF9E81EE7
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E86460 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,2_2_00007FFDF9E86460
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8218F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,2_2_00007FFDF9E8218F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81CC1 EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,2_2_00007FFDF9E81CC1
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECE7E0 CRYPTO_free,2_2_00007FFDF9ECE7E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E824DC CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memmove,2_2_00007FFDF9E824DC
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E927B0 CRYPTO_THREAD_run_once,2_2_00007FFDF9E927B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC27A0 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,2_2_00007FFDF9EC27A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC4790 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,2_2_00007FFDF9EC4790
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E826F8 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memmove,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,2_2_00007FFDF9E826F8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECE780 CRYPTO_free,2_2_00007FFDF9ECE780
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memmove,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,2_2_00007FFDF9E81B54
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,2_2_00007FFDF9E8198D
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E9E727 CRYPTO_THREAD_write_lock,2_2_00007FFDF9E9E727
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA26D0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memmove,CRYPTO_new_ex_data,2_2_00007FFDF9EA26D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EB46A0 CRYPTO_realloc,memmove,ERR_new,ERR_set_debug,ERR_set_error,2_2_00007FFDF9EB46A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8223E ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,2_2_00007FFDF9E8223E
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81217 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,2_2_00007FFDF9E81217
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4050 PyArg_ParseTupleAndKeywords,CryptGetHashParam,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,CryptGetHashParam,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyExc_NotImplementedError,PyErr_Format,PyBytes_FromStringAndSize,PyLong_FromUnsignedLong,free,2_2_00007FFE0C0A4050
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AA040 PyArg_ParseTupleAndKeywords,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CryptFindLocalizedName,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,2_2_00007FFE0C0AA040
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4440 PyArg_ParseTupleAndKeywords,PyExc_TypeError,PyErr_SetString,CryptExportKey,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,CryptExportKey,PyBytes_FromStringAndSize,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,2_2_00007FFE0C0A4440
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5C70 _PyArg_ParseTupleAndKeywords_SizeT,CryptExportPublicKeyInfo,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,CryptExportPublicKeyInfo,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,2_2_00007FFE0C0A5C70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5890 _PyArg_ParseTupleAndKeywords_SizeT,malloc,PyExc_MemoryError,PyErr_Format,memset,memcpy,CryptGenRandom,PyBytes_FromStringAndSize,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,2_2_00007FFE0C0A5890
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AAC80 PyArg_ParseTupleAndKeywords,PyExc_ValueError,PyErr_SetString,PyExc_TypeError,PyErr_SetString,PyArg_ParseTuple,PyLong_AsLong,PyErr_Occurred,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyBytes_AsString,PyEval_SaveThread,CryptFindOIDInfo,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0AAC80
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4880 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,PyExc_TypeError,PyErr_SetString,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,CryptEncrypt,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyErr_NoMemory,CryptEncrypt,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,free,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0A4880
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A50A0 _PyArg_ParseTupleAndKeywords_SizeT,CryptGenKey,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A50A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AC8D0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptVerifyMessageSignature,PyEval_RestoreThread,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,_Py_NoneStruct,Py_BuildValue,malloc,PyErr_NoMemory,PyEval_SaveThread,CryptVerifyMessageSignature,PyEval_RestoreThread,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,PyBytes_FromStringAndSize,Py_BuildValue,free,CertFreeCertificateContext,??1PyWinBufferView@@QEAA@XZ,free,2_2_00007FFE0C0AC8D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AD0F0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptVerifyDetachedMessageSignature,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,free,free,??1PyWinBufferView@@QEAA@XZ,free,2_2_00007FFE0C0AD0F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3D10 PyArg_ParseTupleAndKeywords,PyExc_TypeError,PyErr_SetString,CryptHashSessionKey,_Py_NoneStruct,_Py_NoneStruct,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A3D10
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AED00 PyArg_ParseTupleAndKeywords,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CryptStringToBinaryW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,PyEval_SaveThread,CryptStringToBinaryW,PyEval_RestoreThread,_Py_Dealloc,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,Py_BuildValue,PyMem_Free,2_2_00007FFE0C0AED00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0ACD50 PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptGetMessageSignerCount,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyLong_FromLong,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0ACD50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A2D50 PyExc_ValueError,PyErr_SetString,PyArg_ParseTupleAndKeywords,PyEval_SaveThread,CryptAcquireCertificatePrivateKey,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,CryptContextAddRef,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NewReference,Py_BuildValue,2_2_00007FFE0C0A2D50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A9940 PyList_New,PyEval_SaveThread,CryptEnumProvidersW,PyEval_RestoreThread,malloc,PyEval_SaveThread,CryptEnumProvidersW,PyEval_RestoreThread,Py_BuildValue,PyList_Append,_Py_Dealloc,free,PyEval_SaveThread,CryptEnumProvidersW,PyEval_RestoreThread,GetLastError,_Py_Dealloc,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_Dealloc,free,GetLastError,free,PyExc_MemoryError,PyErr_Format,2_2_00007FFE0C0A9940
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4D40 CryptMsgClose,_Py_Dealloc,2_2_00007FFE0C0A4D40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AE570 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,PyLong_AsVoidPtr,PyErr_Occurred,PyErr_Clear,PyBytes_AsString,PyExc_ValueError,PyErr_Format,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,_Py_NoneStruct,PyExc_ValueError,PyErr_SetString,PyEval_SaveThread,CryptFormatObject,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,PyEval_SaveThread,CryptFormatObject,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,free,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0AE570
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5180 _PyArg_ParseTupleAndKeywords_SizeT,CryptGetProvParam,malloc,PyExc_MemoryError,PyErr_Format,CryptGetProvParam,PyExc_NotImplementedError,PyErr_SetString,free,CryptGetProvParam,PyBool_FromLong,PyList_New,CryptGetProvParam,?PyWinCoreString_FromString@@YAPEAU_object@@PEBD_J@Z,?PyWinCoreString_FromString@@YAPEAU_object@@PEBD_J@Z,_Py_BuildValue_SizeT,PyList_Append,_Py_Dealloc,CryptGetProvParam,_Py_Dealloc,CryptGetProvParam,GetLastError,malloc,PyList_New,CryptGetProvParam,?PyWinCoreString_FromString@@YAPEAU_object@@PEBD_J@Z,PyList_Append,_Py_Dealloc,CryptGetProvParam,_Py_Dealloc,GetLastError,_Py_Dealloc,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,PyList_New,CryptGetProvParam,?PyWinCoreString_FromString@@YAPEAU_object@@PEBD_J@Z,_Py_BuildValue_SizeT,PyList_Append,_Py_Dealloc,CryptGetProvParam,_Py_Dealloc,GetLastError,_Py_Dealloc,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A5180
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4D80 CryptMsgClose,_Py_Dealloc,2_2_00007FFE0C0A4D80
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AB1B0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,?init@PyWinBufferView@@QEAA_NPEAU_object@@_N1@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,PyEval_SaveThread,CryptEnumKeyIdentifierProperties,PyEval_RestoreThread,_Py_Dealloc,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,??1PyWinBufferView@@QEAA@XZ,PyMem_Free,2_2_00007FFE0C0AB1B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AC5B0 PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptSignAndEncryptMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,PyEval_SaveThread,CryptSignAndEncryptMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,CertFreeCertificateContext,free,CertFreeCertificateContext,free,free,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0AC5B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5DB0 _PyArg_ParseTupleAndKeywords_SizeT,PyExc_TypeError,PyErr_SetString,_PyArg_ParseTupleAndKeywords_SizeT,CryptImportPublicKeyInfo,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A5DB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A9DD0 PyArg_ParseTupleAndKeywords,PyEval_SaveThread,CryptGetDefaultProviderW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,PyEval_SaveThread,CryptGetDefaultProviderW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,free,2_2_00007FFE0C0A9DD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A91D0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,_Py_NoneStruct,PyExc_TypeError,PyErr_SetString,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,??1PyWinBufferView@@QEAA@XZ,??1PyWinBufferView@@QEAA@XZ,_Py_NoneStruct,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,??1PyWinBufferView@@QEAA@XZ,??1PyWinBufferView@@QEAA@XZ,_Py_NoneStruct,PyEval_SaveThread,CryptProtectData,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,LocalFree,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyMem_Free,2_2_00007FFE0C0A91D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4DD0 CryptMsgClose,_Py_Dealloc,2_2_00007FFE0C0A4DD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3DD0 PyArg_ParseTupleAndKeywords,CryptSignHashW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,CryptSignHashW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,free,2_2_00007FFE0C0A3DD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A45D0 PyArg_ParseTupleAndKeywords,CryptGetKeyParam,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,CryptGetKeyParam,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyExc_NotImplementedError,PyErr_SetString,free,2_2_00007FFE0C0A45D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A59C0 _Py_NoneStruct,_PyArg_ParseTupleAndKeywords_SizeT,PyExc_TypeError,PyErr_SetString,CryptCreateHash,_Py_NewReference,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A59C0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AAE30 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CryptGetKeyIdentifierProperty,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyExc_NotImplementedError,PyErr_SetString,LocalFree,??1PyWinBufferView@@QEAA@XZ,PyMem_Free,2_2_00007FFE0C0AAE30
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4A50 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,PyExc_TypeError,PyErr_SetString,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,malloc,PyErr_NoMemory,memcpy,CryptDecrypt,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,free,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0A4A50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0ACE40 PyArg_ParseTupleAndKeywords,PyEval_SaveThread,CryptSignMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyExc_MemoryError,PyErr_Format,PyEval_SaveThread,CryptSignMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,CertFreeCertificateContext,free,free,free,free,2_2_00007FFE0C0ACE40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4E70 CryptMsgClose,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,2_2_00007FFE0C0A4E70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3A70 CryptDestroyHash,2_2_00007FFE0C0A3A70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3A60 CryptDestroyHash,2_2_00007FFE0C0A3A60
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0ABA90 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptDecodeMessage,PyEval_RestoreThread,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,??1PyWinBufferView@@QEAA@XZ,free,CertCloseStore,free,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,_Py_NoneStruct,Py_BuildValue,malloc,PyErr_NoMemory,PyEval_SaveThread,CryptDecodeMessage,PyEval_RestoreThread,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,PyBytes_FromStringAndSize,Py_BuildValue,free,CertFreeCertificateContext,CertFreeCertificateContext,2_2_00007FFE0C0ABA90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4290 _Py_Dealloc,_Py_Dealloc,CryptDestroyKey,2_2_00007FFE0C0A4290
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3AA0 CryptDestroyHash,2_2_00007FFE0C0A3AA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AD2F0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptDecryptAndVerifyMessageSignature,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyErr_NoMemory,PyEval_SaveThread,CryptDecryptAndVerifyMessageSignature,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,PyBytes_FromStringAndSize,Py_BuildValue,free,??1PyWinBufferView@@QEAA@XZ,free,CertCloseStore,free,2_2_00007FFE0C0AD2F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AB6E0 PyArg_ParseTupleAndKeywords,PyExc_ValueError,PyErr_Format,?init@PyWinBufferView@@QEAA_NPEAU_object@@_N1@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CryptQueryObject,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,PyLong_FromVoidPtr,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,PyLong_FromVoidPtr,Py_BuildValue,??1PyWinBufferView@@QEAA@XZ,PyMem_Free,2_2_00007FFE0C0AB6E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AD6E0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,PyLong_AsVoidPtr,PyErr_Occurred,PyErr_Clear,PyBytes_AsString,PyExc_ValueError,PyErr_Format,_Py_NoneStruct,PyExc_NotImplementedError,PyErr_SetString,strcmp,malloc,PyExc_MemoryError,PyErr_Format,strcmp,PyExc_NotImplementedError,PyErr_Format,PyErr_Format,malloc,PyEval_SaveThread,CryptEncodeObjectEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,strcmp,free,LocalFree,2_2_00007FFE0C0AD6E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A42E0 _Py_Dealloc,_Py_Dealloc,CryptDestroyKey,2_2_00007FFE0C0A42E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3B10 CryptDestroyHash,_Py_NoneStruct,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A3B10
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4F10 CryptReleaseContext,2_2_00007FFE0C0A4F10
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5B00 _Py_NoneStruct,_PyArg_ParseTupleAndKeywords_SizeT,PyExc_TypeError,PyErr_SetString,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,CryptImportKey,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0A5B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A9F30 PyArg_ParseTupleAndKeywords,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CryptSetProviderExW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,2_2_00007FFE0C0A9F30
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3F20 PyArg_ParseTupleAndKeywords,PyExc_TypeError,PyErr_SetString,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,CryptVerifySignatureW,_Py_NoneStruct,_Py_NoneStruct,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0A3F20
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4F20 CryptReleaseContext,2_2_00007FFE0C0A4F20
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3B50 PyArg_ParseTupleAndKeywords,CryptDuplicateHash,_Py_NewReference,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A3B50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4F50 CryptReleaseContext,2_2_00007FFE0C0A4F50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AC340 PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptDecryptMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyErr_NoMemory,PyEval_SaveThread,CryptDecryptMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,free,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,PyBytes_FromStringAndSize,Py_BuildValue,free,??1PyWinBufferView@@QEAA@XZ,CertCloseStore,free,2_2_00007FFE0C0AC340
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4340 _Py_Dealloc,_Py_Dealloc,CryptDestroyKey,2_2_00007FFE0C0A4340
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AEB70 PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyEval_SaveThread,CryptBinaryToStringW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,malloc,PyErr_NoMemory,PyEval_SaveThread,CryptBinaryToStringW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,free,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0AEB70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A476B PyArg_ParseTupleAndKeywords,CryptDuplicateKey,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A476B
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A9B80 PyList_New,PyEval_SaveThread,CryptEnumProviderTypesW,PyEval_RestoreThread,malloc,PyEval_SaveThread,CryptEnumProviderTypesW,PyEval_RestoreThread,_Py_NoneStruct,Py_BuildValue,PyList_Append,_Py_Dealloc,free,PyEval_SaveThread,CryptEnumProviderTypesW,PyEval_RestoreThread,GetLastError,_Py_Dealloc,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_Dealloc,free,GetLastError,free,PyExc_MemoryError,PyErr_Format,2_2_00007FFE0C0A9B80
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A97B0 PyArg_ParseTupleAndKeywords,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CryptAcquireContextW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,_Py_NewReference,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,2_2_00007FFE0C0A97B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A57A1 _PyArg_ParseTupleAndKeywords_SizeT,CryptGetUserKey,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A57A1
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0ACBD0 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,CryptGetMessageCertificates,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NewReference,PyLong_FromVoidPtr,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0ACBD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AB3D0 PyArg_ParseTupleAndKeywords,PyList_New,PyEval_SaveThread,CryptEnumOIDInfo,PyEval_RestoreThread,_Py_Dealloc,PyErr_Occurred,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0AB3D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AC000 PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z,malloc,PyErr_NoMemory,_Py_Dealloc,??1PyWinBufferView@@QEAA@XZ,memset,CertDuplicateCertificateContext,_Py_Dealloc,PyEval_SaveThread,CryptEncryptMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyExc_ValueError,PyExc_TypeError,PyErr_SetString,CertFreeCertificateContext,free,malloc,PyExc_MemoryError,PyErr_Format,PyEval_SaveThread,CryptEncryptMessage,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,CertFreeCertificateContext,free,free,2_2_00007FFE0C0AC000
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A4400 CryptDestroyKey,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,2_2_00007FFE0C0A4400
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A9430 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,_Py_NoneStruct,PyExc_TypeError,PyErr_SetString,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,??1PyWinBufferView@@QEAA@XZ,??1PyWinBufferView@@QEAA@XZ,_Py_NoneStruct,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,??1PyWinBufferView@@QEAA@XZ,_Py_NoneStruct,PyEval_SaveThread,CryptUnprotectData,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyBytes_FromStringAndSize,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,Py_BuildValue,LocalFree,LocalFree,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,2_2_00007FFE0C0A9430
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A3C20 PyArg_ParseTupleAndKeywords,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,CryptHashData,_Py_NoneStruct,_Py_NoneStruct,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0A3C20
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5020 _PyArg_ParseTupleAndKeywords_SizeT,CryptReleaseContext,_Py_NoneStruct,_Py_NoneStruct,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,2_2_00007FFE0C0A5020
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB44EA8 ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,_Py_BuildValue_SizeT,ASN1_STRING_to_UTF8,_Py_Dealloc,_Py_BuildValue_SizeT,CRYPTO_free,2_2_00007FFE0EB44EA8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB44C24 i2d_X509,PyBytes_FromStringAndSize,CRYPTO_free,2_2_00007FFE0EB44C24
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE103018F0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,2_2_00007FFE103018F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE103061C4 CRYPTO_memcmp,2_2_00007FFE103061C4
    Source: prank.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
    Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: prank.exe, 00000002.00000002.1896917153.00007FFDF9E70000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: prank.exe, 00000002.00000002.1905065850.00007FFDFF6D0000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32crypt.pdb source: prank.exe, 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: prank.exe, 00000002.00000002.1898542111.00007FFDFA2F1000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: prank.exe, 00000002.00000002.1905065850.00007FFDFF6D0000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: prank.exe, 00000000.00000003.1811697216.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911840395.00007FFE13311000.00000002.00000001.01000000.00000005.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: prank.exe, 00000000.00000003.1811697216.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911840395.00007FFE13311000.00000002.00000001.01000000.00000005.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: prank.exe, 00000002.00000002.1902230068.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: prank.exe, 00000000.00000003.1811826864.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: prank.exe, 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: prank.exe, 00000002.00000002.1911210251.00007FFE126F0000.00000002.00000001.01000000.00000007.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1910444327.00007FFE10307000.00000002.00000001.01000000.0000000D.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32crypt.pdb!! source: prank.exe, 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.9 30 May 20233.0.9built on: Tue Jul 11 19:52:20 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: prank.exe, 00000002.00000002.1898542111.00007FFDFA2F1000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: prank.exe, 00000002.00000002.1897460157.00007FFDF9F05000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1910791509.00007FFE1151C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: prank.exe, 00000002.00000002.1911504319.00007FFE130C2000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911365365.00007FFE12E13000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1910791509.00007FFE1151C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911057659.00007FFE126CD000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: prank.exe, 00000002.00000002.1910283693.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: prank.exe, 00000002.00000002.1887177772.0000028E10B70000.00000002.00000001.01000000.00000006.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: prank.exe, 00000000.00000003.1811826864.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdb source: prank.exe, 00000002.00000002.1897460157.00007FFDF9F05000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: prank.exe, 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmp
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137FC0 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF736137FC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736127B30 FindFirstFileExW,FindClose,0_2_00007FF736127B30
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736141F84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF736141F84
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137FC0 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF736137FC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc,2_2_00007FFE014C2E70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE102557F4 recv,2_2_00007FFE102557F4
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
    Source: prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
    Source: prank.exe, 00000002.00000002.1899769918.00007FFDFA798000.00000008.00000001.01000000.0000000C.sdmpString found in binary or memory: http://.css
    Source: prank.exe, 00000002.00000002.1899769918.00007FFDFA798000.00000008.00000001.01000000.0000000C.sdmpString found in binary or memory: http://.jpg
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E3735E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E374F8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
    Source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
    Source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co2
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
    Source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
    Source: prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E3735E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866442063.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875151604.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871500525.0000028E3735B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868799090.0000028E112B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892504829.0000028E374D8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E37338000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
    Source: prank.exe, 00000002.00000003.1839930528.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872343544.0000028E374C5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892411230.0000028E374C7000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
    Source: prank.exe, 00000002.00000003.1854431481.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872915494.0000028E373CE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874695603.0000028E37400000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1890787483.0000028E37160000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1891768614.0000028E37404000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866013953.0000028E37441000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
    Source: prank.exe, 00000002.00000003.1834416637.0000028E111DE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E11204000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832937204.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833115817.0000028E11203000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E111E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833215036.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
    Source: prank.exe, 00000002.00000003.1878543121.0000028E373AD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373AD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
    Source: prank.exe, 00000002.00000003.1872915494.0000028E373CE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874410084.0000028E373D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
    Source: prank.exe, 00000002.00000002.1889483983.0000028E1126C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877852698.0000028E1126C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
    Source: prank.exe, 00000002.00000003.1875582380.0000028E37286000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1857004157.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854612279.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E3727B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876921072.0000028E37281000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841805763.0000028E11173000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852177185.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1891129141.0000028E37281000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872385003.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876435320.0000028E111D8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868223898.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872471401.0000028E111D1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875676996.0000028E37280000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3727B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
    Source: prank.exe, 00000002.00000002.1899769918.00007FFDFA798000.00000008.00000001.01000000.0000000C.sdmpString found in binary or memory: http://html4/loose.dtd
    Source: prank.exe, 00000002.00000003.1865173014.0000028E1102B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873537357.0000028E1108E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1870998058.0000028E1107A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887906027.0000028E1108F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873015511.0000028E1107C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1882864369.0000028E1108F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1870608022.0000028E11043000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
    Source: prank.exe, 00000002.00000003.1872915494.0000028E373CE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874937040.0000028E110FA000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874410084.0000028E373D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
    Source: prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868480615.0000028E374C1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872343544.0000028E374C5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892411230.0000028E374C7000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
    Source: prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
    Source: prank.exe, 00000002.00000003.1831869208.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832079756.0000028E111CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832287020.0000028E11220000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831804483.0000028E11220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
    Source: prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E37338000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871784714.0000028E37342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
    Source: prank.exe, 00000002.00000003.1831869208.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832287020.0000028E11220000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831804483.0000028E11220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
    Source: prank.exe, 00000002.00000003.1831869208.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832079756.0000028E111CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832287020.0000028E11220000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832390054.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831804483.0000028E11220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892443749.0000028E374D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
    Source: prank.exe, 00000002.00000003.1834797489.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832937204.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1857004157.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833115817.0000028E11203000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854612279.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E1116B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833215036.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841805763.0000028E11173000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852177185.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872385003.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868223898.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1880991799.0000028E1117B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E38574000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
    Source: prank.exe, 00000002.00000002.1894830451.0000028E38594000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
    Source: prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
    Source: prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com
    Source: prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/
    Source: prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
    Source: prank.exe, 00000002.00000003.1835206742.0000028E110CC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/channels/
    Source: prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/invites/
    Source: prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
    Source: prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/z
    Source: prank.exe, 00000002.00000003.1876786375.0000028E110DB000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1858604617.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847325256.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839252495.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842705396.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865421881.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863057950.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835206742.0000028E110CC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1840360496.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868732851.0000028E110D3000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854674556.0000028E110BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
    Source: prank.exe, 00000002.00000002.1889895762.0000028E11510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
    Source: prank.exe, 00000002.00000003.1880799015.0000028E37424000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1869303294.0000028E37424000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863577290.0000028E3740A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866672361.0000028E37423000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1891807486.0000028E37424000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1879299367.0000028E37424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
    Source: prank.exe, 00000002.00000003.1869964239.0000028E0F35A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831560757.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887081651.0000028E0F362000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877413621.0000028E0F35E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827863298.0000028E0F36B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
    Source: prank.exe, prank.exe, 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmp, prank.exe, 00000002.00000002.1905148694.00007FFDFF6E1000.00000002.00000001.01000000.0000002B.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
    Source: prank.exe, 00000002.00000003.1873786178.0000028E11160000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832390054.0000028E111E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests)
    Source: prank.exe, 00000002.00000002.1887268122.0000028E10C38000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
    Source: prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
    Source: prank.exe, 00000002.00000003.1869964239.0000028E0F35A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831560757.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887081651.0000028E0F362000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877413621.0000028E0F35E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827863298.0000028E0F36B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
    Source: prank.exe, 00000002.00000003.1834797489.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832734511.0000028E111EE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832191401.0000028E1127B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1857004157.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873972307.0000028E11185000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854612279.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1880317278.0000028E1118B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E1116B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841805763.0000028E11173000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852177185.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872385003.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868223898.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1888860563.0000028E1118D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832668495.0000028E1127B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873728149.0000028E11182000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832357990.0000028E111ED000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
    Source: prank.exe, 00000002.00000003.1869964239.0000028E0F35A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831560757.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887081651.0000028E0F362000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877413621.0000028E0F35E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827863298.0000028E0F36B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
    Source: prank.exe, 00000002.00000002.1889895762.0000028E11510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
    Source: prank.exe, 00000002.00000003.1874695603.0000028E373EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875951043.0000028E373F8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873577136.0000028E373ED000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
    Source: prank.exe, 00000002.00000002.1893023054.0000028E37670000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
    Source: prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
    Source: prank.exe, 00000002.00000003.1874695603.0000028E37400000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872831800.0000028E110FE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872955913.0000028E373FD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
    Source: prank.exe, 00000002.00000003.1879616485.0000028E1114C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
    Source: prank.exe, 00000002.00000003.1875705420.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876712755.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873823517.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1869829394.0000028E0F304000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1886735277.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871735777.0000028E0F30A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
    Source: prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
    Source: prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1879299367.0000028E3741D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
    Source: prank.exe, 00000002.00000003.1851513864.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875244927.0000028E37320000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
    Source: prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
    Source: prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
    Source: prank.exe, 00000002.00000002.1894830451.0000028E38558000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E38584000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
    Source: prank.exe, 00000002.00000003.1879261481.0000028E112C0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834124515.0000028E112A1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835236998.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834557973.0000028E110DA000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834194794.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889638171.0000028E112D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866442063.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875151604.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868799090.0000028E112B0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877687073.0000028E112C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892443749.0000028E374D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
    Source: prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://paste-pgpj.onrender.com/?p=
    Source: prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paste-pgpj.onrender.com/?p=r
    Source: prank.exe, 00000002.00000003.1834416637.0000028E111DE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E11204000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E111E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835278362.0000028E11214000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
    Source: prank.exe, 00000002.00000002.1902230068.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://peps.python.org/pep-0263/
    Source: prank.exe, 00000002.00000003.1851513864.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875244927.0000028E37320000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
    Source: prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.ioP5
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
    Source: prank.exe, 00000002.00000003.1851424520.0000028E3757B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3757B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852659707.0000028E3765D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848894591.0000028E3765D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3727B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
    Source: prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
    Source: prank.exe, 00000002.00000003.1874695603.0000028E373EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875951043.0000028E373F8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873577136.0000028E373ED000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842705396.0000028E1109E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
    Source: prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/Bm
    Source: prank.exe, 00000002.00000003.1880282584.0000028E11111000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1888321037.0000028E11119000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1883443720.0000028E11115000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868932109.0000028E1110B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881635914.0000028E11112000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892504829.0000028E374D8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E37338000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
    Source: prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
    Source: prank.exe, 00000002.00000003.1864676927.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868588639.0000028E11229000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874410084.0000028E373E1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E1121C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
    Source: prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
    Source: prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyR
    Source: prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
    Source: prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
    Source: prank.exe, 00000002.00000003.1864676927.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868588639.0000028E11229000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871340825.0000028E11247000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E1121C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872714916.0000028E1124D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
    Source: prank.exe, 00000002.00000002.1894165926.0000028E37E38000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851424520.0000028E3757B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3757B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852659707.0000028E3765D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853274448.0000028E37E98000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848894591.0000028E3765D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3727B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
    Source: prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868480615.0000028E374C1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872343544.0000028E374C5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892411230.0000028E374C7000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
    Source: prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
    Source: prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
    Source: prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
    Source: prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
    Source: prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
    Source: prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
    Source: prank.exe, 00000002.00000003.1844340938.0000028E3757B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E3757B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876056408.0000028E110F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
    Source: prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
    Source: prank.exe, 00000002.00000002.1894830451.0000028E38594000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
    Source: prank.exe, 00000002.00000002.1897615871.00007FFDF9F40000.00000002.00000001.01000000.00000012.sdmp, prank.exe, 00000002.00000002.1899277760.00007FFDFA432000.00000002.00000001.01000000.0000000E.sdmpString found in binary or memory: https://www.openssl.org/H
    Source: prank.exe, 00000002.00000003.1851513864.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875244927.0000028E37320000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
    Source: prank.exe, 00000002.00000003.1879261481.0000028E112C0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834124515.0000028E112A1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835206742.0000028E110CC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835236998.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834557973.0000028E110DA000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834194794.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889638171.0000028E112D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866442063.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875151604.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868799090.0000028E112B0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877687073.0000028E112C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
    Source: prank.exe, 00000002.00000002.1887268122.0000028E10BB0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1828848874.0000028E1104E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
    Source: prank.exe, 00000002.00000002.1902775572.00007FFDFB918000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://www.python.org/psf/license/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
    Source: prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
    Source: prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xvirus.lol
    Source: prank.exe, 00000002.00000003.1874695603.0000028E37400000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872831800.0000028E110FE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872955913.0000028E373FD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A5B00 _Py_NoneStruct,_PyArg_ParseTupleAndKeywords_SizeT,PyExc_TypeError,PyErr_SetString,??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z,CryptImportKey,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,??1PyWinBufferView@@QEAA@XZ,2_2_00007FFE0C0A5B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C1E90 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,_Py_Dealloc,free,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,_Py_Dealloc,free,_Py_Dealloc,2_2_00007FFE014C1E90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C4680 PyArg_ParseTuple,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,Py_BuildValue,PyUnicode_FromWideChar,GetProcessHeap,HeapFree,PyErr_NoMemory,2_2_00007FFE014C4680
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C73F0 malloc,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,free,free,2_2_00007FFE014C73F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2480 GetActiveProcessorCount,PyErr_SetFromWindowsErr,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,NtQuerySystemInformation,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,free,free,free,free,Py_BuildValue,2_2_00007FFE014C2480
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C6AA0 OpenProcess,GetLastError,NtQueryInformationProcess,RtlNtStatusToDosErrorNoTeb,PyErr_SetFromWindowsErrWithFilename,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,ReadProcessMemory,NtQueryInformationProcess,CloseHandle,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,GetLastError,PyErr_SetFromWindowsErrWithFilename,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,free,CloseHandle,2_2_00007FFE014C6AA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C6250 GetProcessHeap,HeapAlloc,GetFileType,SetLastError,NtQueryObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,PyErr_NoMemory,GetProcessHeap,HeapFree,2_2_00007FFE014C6250
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C6E40 PyExc_RuntimeError,PyErr_SetString,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,NtQueryInformationProcess,calloc,PyErr_NoMemory,free,CloseHandle,wcscpy_s,free,CloseHandle,2_2_00007FFE014C6E40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C4A70 PyArg_ParseTuple,OpenProcess,GetLastError,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,CloseHandle,PyErr_Clear,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,PyErr_NoMemory,CloseHandle,2_2_00007FFE014C4A70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C5810 PyArg_ParseTuple,OpenProcess,GetLastError,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,2_2_00007FFE014C5810
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C4D00 PyArg_ParseTuple,OpenProcess,GetLastError,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,2_2_00007FFE014C4D00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C6600 PyList_New,EnterCriticalSection,GetProcessHeap,HeapAlloc,PyErr_NoMemory,_Py_Dealloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,PyExc_RuntimeError,PyErr_SetString,GetCurrentProcess,DuplicateHandle,PyUnicode_FromWideChar,PyList_Append,_Py_Dealloc,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,_Py_Dealloc,GetProcessHeap,HeapFree,LeaveCriticalSection,2_2_00007FFE014C6600
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C5720 PyArg_ParseTuple,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,Py_BuildValue,2_2_00007FFE014C5720
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2B00: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle,2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137FC00_2_00007FF736137FC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73614735C0_2_00007FF73614735C
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361464100_2_00007FF736146410
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736126B000_2_00007FF736126B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361317540_2_00007FF736131754
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736130F340_2_00007FF736130F34
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736141F840_2_00007FF736141F84
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361447BC0_2_00007FF7361447BC
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736140FD80_2_00007FF736140FD8
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361388440_2_00007FF736138844
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361360300_2_00007FF736136030
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73614A0980_2_00007FF73614A098
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137FC00_2_00007FF736137FC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361315500_2_00007FF736131550
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736130D300_2_00007FF736130D30
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613A5A00_2_00007FF73613A5A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361336040_2_00007FF736133604
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137E0C0_2_00007FF736137E0C
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736146E100_2_00007FF736146E10
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613E6200_2_00007FF73613E620
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73614668C0_2_00007FF73614668C
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361326B40_2_00007FF7361326B4
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361313440_2_00007FF736131344
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613231C0_2_00007FF73613231C
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361443200_2_00007FF736144320
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736140FD80_2_00007FF736140FD8
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361284500_2_00007FF736128450
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613ECA00_2_00007FF73613ECA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361311400_2_00007FF736131140
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613E18C0_2_00007FF73613E18C
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361331CC0_2_00007FF7361331CC
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736133A080_2_00007FF736133A08
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9D618A02_2_00007FFDF9D618A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81FE62_2_00007FFDF9E81FE6
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC98B02_2_00007FFDF9EC98B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECD8702_2_00007FFDF9ECD870
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E815412_2_00007FFDF9E81541
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EABD902_2_00007FFDF9EABD90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9ECDD402_2_00007FFDF9ECDD40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC5CD02_2_00007FFDF9EC5CD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E821F32_2_00007FFDF9E821F3
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E815912_2_00007FFDF9E81591
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EF31E02_2_00007FFDF9EF31E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8149C2_2_00007FFDF9E8149C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E811812_2_00007FFDF9E81181
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E824EB2_2_00007FFDF9E824EB
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E813DE2_2_00007FFDF9E813DE
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E976302_2_00007FFDF9E97630
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81C122_2_00007FFDF9E81C12
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E821D52_2_00007FFDF9E821D5
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E815552_2_00007FFDF9E81555
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81A0F2_2_00007FFDF9E81A0F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EECC502_2_00007FFDF9EECC50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E88BE02_2_00007FFDF9E88BE0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E816FE2_2_00007FFDF9E816FE
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EB8A902_2_00007FFDF9EB8A90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8143D2_2_00007FFDF9E8143D
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E817F82_2_00007FFDF9E817F8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E8262B2_2_00007FFDF9E8262B
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E827162_2_00007FFDF9E82716
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E816132_2_00007FFDF9E81613
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EC0EA02_2_00007FFDF9EC0EA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81AD72_2_00007FFDF9E81AD7
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA62A02_2_00007FFDF9EA62A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E811722_2_00007FFDF9E81172
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EFA5F02_2_00007FFDF9EFA5F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81D982_2_00007FFDF9E81D98
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81EE72_2_00007FFDF9E81EE7
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81CC12_2_00007FFDF9E81CC1
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81B542_2_00007FFDF9E81B54
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C1E902_2_00007FFE014C1E90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C39902_2_00007FFE014C3990
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2E702_2_00007FFE014C2E70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2B002_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C66002_2_00007FFE014C6600
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C8F302_2_00007FFE014C8F30
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C99D02_2_00007FFE014C99D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C4DF02_2_00007FFE014C4DF0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A51802_2_00007FFE0C0A5180
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A91D02_2_00007FFE0C0A91D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0A94302_2_00007FFE0C0A9430
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CF924402_2_00007FFE0CF92440
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CF91FD02_2_00007FFE0CF91FD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFA45D02_2_00007FFE0CFA45D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFA48202_2_00007FFE0CFA4820
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB29C02_2_00007FFE0CFB29C0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB2EC02_2_00007FFE0CFB2EC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB35502_2_00007FFE0CFB3550
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB1FF02_2_00007FFE0CFB1FF0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB1D802_2_00007FFE0CFB1D80
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB24A02_2_00007FFE0CFB24A0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFC1D402_2_00007FFE0CFC1D40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFC21302_2_00007FFE0CFC2130
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFD21C02_2_00007FFE0CFD21C0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFD1F102_2_00007FFE0CFD1F10
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E131FA02_2_00007FFE0E131FA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E1422702_2_00007FFE0E142270
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E141D402_2_00007FFE0E141D40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E1423802_2_00007FFE0E142380
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E151D402_2_00007FFE0E151D40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E1525502_2_00007FFE0E152550
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E16BDA02_2_00007FFE0E16BDA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E16FDC02_2_00007FFE0E16FDC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EA722D02_2_00007FFE0EA722D0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EA71D402_2_00007FFE0EA71D40
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB221602_2_00007FFE0EB22160
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB320702_2_00007FFE0EB32070
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB483182_2_00007FFE0EB48318
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB4B6C82_2_00007FFE0EB4B6C8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB4A0F42_2_00007FFE0EB4A0F4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB49AB42_2_00007FFE0EB49AB4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB496BC2_2_00007FFE0EB496BC
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB4A4402_2_00007FFE0EB4A440
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB489D42_2_00007FFE0EB489D4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB457502_2_00007FFE0EB45750
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE101E22202_2_00007FFE101E2220
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE102510602_2_00007FFE10251060
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE103012B02_2_00007FFE103012B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE103018F02_2_00007FFE103018F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE103010002_2_00007FFE10301000
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11508D902_2_00007FFE11508D90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE1150F86C2_2_00007FFE1150F86C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11505D302_2_00007FFE11505D30
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE115025302_2_00007FFE11502530
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11501BB02_2_00007FFE11501BB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11502FF02_2_00007FFE11502FF0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE115053F02_2_00007FFE115053F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE115012B02_2_00007FFE115012B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11506EFC2_2_00007FFE11506EFC
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126C60B02_2_00007FFE126C60B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126C2EB02_2_00007FFE126C2EB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126C3E602_2_00007FFE126C3E60
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126C10002_2_00007FFE126C1000
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126CC7F02_2_00007FFE126CC7F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126C3BD02_2_00007FFE126C3BD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126E32002_2_00007FFE126E3200
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE133077742_2_00007FFE13307774
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E2ED02_2_00007FFE148E2ED0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E39F02_2_00007FFE148E39F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E32E02_2_00007FFE148E32E0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E3F502_2_00007FFE148E3F50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E1F502_2_00007FFE148E1F50
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E27A02_2_00007FFE148E27A0
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFCE19 appears 31 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFCD29 appears 49 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDFF6CC090 appears 47 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFD3FB appears 69 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFE0E163770 appears 96 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFD3EF appears 39 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9E8132A appears 466 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFE0E163700 appears 51 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FF736121FB0 appears 52 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFE014C1070 appears 43 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFE014C1D70 appears 39 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFCC4B appears 39 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFCC51 appears 1190 times
    Source: C:\Users\user\Desktop\prank.exeCode function: String function: 00007FFDF9EFCC3F appears 330 times
    Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: tls-client-64.dll.0.drStatic PE information: Number of sections : 23 > 10
    Source: python3.dll.0.drStatic PE information: No import functions for PE file found
    Source: prank.exe, 00000000.00000003.1811826864.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs prank.exe
    Source: prank.exe, 00000000.00000003.1813208064.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs prank.exe
    Source: prank.exe, 00000000.00000003.1812645309.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs prank.exe
    Source: prank.exe, 00000000.00000003.1811697216.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs prank.exe
    Source: prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs prank.exe
    Source: prank.exe, 00000000.00000003.1912329253.00000230F6A86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs prank.exe
    Source: prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs prank.exe
    Source: prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs prank.exe
    Source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs prank.exe
    Source: prank.exeBinary or memory string: OriginalFilename vs prank.exe
    Source: prank.exe, 00000002.00000002.1887177772.0000028E10B70000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs prank.exe
    Source: prank.exe, 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs prank.exe
    Source: prank.exe, 00000002.00000002.1897615871.00007FFDF9F40000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamelibsslH vs prank.exe
    Source: prank.exe, 00000002.00000002.1911111411.00007FFE126D2000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1910499346.00007FFE1030E000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1910368355.00007FFE10262000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1911912715.00007FFE13317000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs prank.exe
    Source: prank.exe, 00000002.00000002.1905148694.00007FFDFF6E1000.00000002.00000001.01000000.0000002B.sdmpBinary or memory string: OriginalFilenamepywintypes311.dll0 vs prank.exe
    Source: prank.exe, 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1899277760.00007FFDFA432000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs prank.exe
    Source: prank.exe, 00000002.00000002.1904925065.00007FFDFBAB7000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython311.dll. vs prank.exe
    Source: prank.exe, 00000002.00000002.1911562171.00007FFE130C4000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1897252803.00007FFDF9E75000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs prank.exe
    Source: prank.exe, 00000002.00000002.1910869081.00007FFE11525000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1911282295.00007FFE126FB000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs prank.exe
    Source: prank.exe, 00000002.00000002.1911421310.00007FFE12E16000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs prank.exe
    Source: C:\Users\user\Desktop\prank.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: libffi-8.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: libcrypto-3.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: libssl-3.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: pywintypes311.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: vcruntime140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: vcruntime140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: pdh.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\prank.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: classification engineClassification label: mal84.troj.spyw.winEXE@4/69@0/0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736127770 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF736127770
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AA8E1 _Py_NoneStruct,PyArg_ParseTupleAndKeywords,PyExc_TypeError,PyErr_SetString,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,CertOpenSystemStoreW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NewReference,PyLong_FromVoidPtr,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,2_2_00007FFE0C0AA8E1
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C7DB0 GetCurrentProcess,OpenProcessToken,GetLastError,ImpersonateSelf,OpenProcessToken,GetLastError,PyErr_SetFromWindowsErrWithFilename,LookupPrivilegeValueA,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,RevertToSelf,CloseHandle,2_2_00007FFE014C7DB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2A30 PyArg_ParseTuple,PyUnicode_AsWideCharString,PyEval_SaveThread,GetDiskFreeSpaceExW,PyEval_RestoreThread,PyMem_Free,PyExc_OSError,PyErr_SetExcFromWindowsErrWithFilenameObject,Py_BuildValue,2_2_00007FFE014C2A30
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C601F PyDict_New,memset,CreateToolhelp32Snapshot,PyErr_SetFromWindowsErr,_Py_Dealloc,Process32First,PyLong_FromLong,PyLong_FromLong,PyDict_SetItem,_Py_Dealloc,_Py_Dealloc,Process32Next,CloseHandle,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseHandle,2_2_00007FFE014C601F
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C8AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,2_2_00007FFE014C8AA0
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\Desktop\log.txtJump to behavior
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602Jump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Windows\system32\1fc840b8b6e6491f5690d05eedfc4fc96452526b2acf24bbd0187a6d7007bcd4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJump to behavior
    Source: prank.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\prank.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: prank.exeReversingLabs: Detection: 66%
    Source: prank.exeVirustotal: Detection: 57%
    Source: C:\Users\user\Desktop\prank.exeFile read: C:\Users\user\Desktop\prank.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\prank.exe "C:\Users\user\Desktop\prank.exe"
    Source: C:\Users\user\Desktop\prank.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\prank.exeProcess created: C:\Users\user\Desktop\prank.exe "C:\Users\user\Desktop\prank.exe"
    Source: C:\Users\user\Desktop\prank.exeProcess created: C:\Users\user\Desktop\prank.exe "C:\Users\user\Desktop\prank.exe"Jump to behavior
    Source: prank.exeStatic PE information: Image base 0x140000000 > 0x60000000
    Source: prank.exeStatic file information: File size 15194423 > 1048576
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
    Source: prank.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
    Source: prank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: prank.exe, 00000002.00000002.1896917153.00007FFDF9E70000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: prank.exe, 00000002.00000002.1905065850.00007FFDFF6D0000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32crypt.pdb source: prank.exe, 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: prank.exe, 00000002.00000002.1898542111.00007FFDFA2F1000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: prank.exe, 00000002.00000002.1905065850.00007FFDFF6D0000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: prank.exe, 00000000.00000003.1811697216.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911840395.00007FFE13311000.00000002.00000001.01000000.00000005.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: prank.exe, 00000000.00000003.1811697216.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911840395.00007FFE13311000.00000002.00000001.01000000.00000005.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: prank.exe, 00000002.00000002.1902230068.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: prank.exe, 00000000.00000003.1811826864.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: prank.exe, 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: prank.exe, 00000002.00000002.1911210251.00007FFE126F0000.00000002.00000001.01000000.00000007.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: prank.exe, 00000000.00000003.1813546119.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1910444327.00007FFE10307000.00000002.00000001.01000000.0000000D.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32crypt.pdb!! source: prank.exe, 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.9 30 May 20233.0.9built on: Tue Jul 11 19:52:20 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: prank.exe, 00000002.00000002.1898542111.00007FFDFA2F1000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: prank.exe, 00000002.00000002.1897460157.00007FFDF9F05000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1910791509.00007FFE1151C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: prank.exe, 00000002.00000002.1911504319.00007FFE130C2000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: prank.exe, 00000000.00000003.1813855985.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911365365.00007FFE12E13000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: prank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1910791509.00007FFE1151C000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: prank.exe, 00000000.00000003.1811953739.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1911057659.00007FFE126CD000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: prank.exe, 00000002.00000002.1910283693.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: prank.exe, 00000002.00000002.1887177772.0000028E10B70000.00000002.00000001.01000000.00000006.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: prank.exe, 00000000.00000003.1811826864.00000230F6A78000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdb source: prank.exe, 00000002.00000002.1897460157.00007FFDF9F05000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: prank.exe, 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmp
    Source: prank.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
    Source: prank.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
    Source: prank.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
    Source: prank.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
    Source: prank.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
    Source: VCRUNTIME140.dll.0.drStatic PE information: 0xC94BF788 [Wed Jan 6 22:49:44 2077 UTC]
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6CDB00 GetModuleHandleW,LoadLibraryW,GetProcAddress,AddAccessAllowedAce,GetProcAddress,AddAccessDeniedAce,GetProcAddress,AddAccessAllowedAceEx,GetProcAddress,AddMandatoryAce,GetProcAddress,AddAccessAllowedObjectAce,GetProcAddress,AddAccessDeniedAceEx,GetProcAddress,AddAccessDeniedObjectAce,GetProcAddress,AddAuditAccessAceEx,GetProcAddress,AddAuditAccessObjectAce,GetProcAddress,SetSecurityDescriptorControl,InitializeCriticalSection,TlsAlloc,DeleteCriticalSection,TlsFree,2_2_00007FFDFF6CDB00
    Source: prank.exeStatic PE information: section name: _RDATA
    Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
    Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
    Source: python311.dll.0.drStatic PE information: section name: PyRuntim
    Source: tls-client-64.dll.0.drStatic PE information: section name: .xdata
    Source: tls-client-64.dll.0.drStatic PE information: section name: /4
    Source: tls-client-64.dll.0.drStatic PE information: section name: /19
    Source: tls-client-64.dll.0.drStatic PE information: section name: /31
    Source: tls-client-64.dll.0.drStatic PE information: section name: /45
    Source: tls-client-64.dll.0.drStatic PE information: section name: /57
    Source: tls-client-64.dll.0.drStatic PE information: section name: /70
    Source: tls-client-64.dll.0.drStatic PE information: section name: /81
    Source: tls-client-64.dll.0.drStatic PE information: section name: /92
    Source: tls-client-64.dll.0.drStatic PE information: section name: /106
    Source: tls-client-64.dll.0.drStatic PE information: section name: /125
    Source: tls-client-64.dll.0.drStatic PE information: section name: /141
    Source: tls-client-64.dll.0.drStatic PE information: section name: /157
    Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81D7B push rcx; retf 2_2_00007FFDF9E81D7C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E81704 push rsp; iretd 2_2_00007FFDF9E81705
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9EA4551 push rcx; ret 2_2_00007FFDF9EA4552

    Persistence and Installation Behavior

    barindex
    Contains functionality to infect the boot sector
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i2_2_00007FFE014C2B00
    Found pyInstaller with non standard icon
    Source: C:\Users\user\Desktop\prank.exeProcess created: "C:\Users\user\Desktop\prank.exe"
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_chacha20.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_ARC4.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_RIPEMD160.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\win32\win32crypt.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA256.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_portable.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_keccak.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\VCRUNTIME140_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cast.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\libssl-3.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\libcrypto-3.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Protocol\_scrypt.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD2.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_arc2.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\psutil\_psutil_windows.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aesni.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ed25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ec_ws.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2s.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2b.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\python311.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\VCRUNTIME140.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32\pywintypes311.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Math\_modexp.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\libffi-8.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD5.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_clmul.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\tls_client\dependencies\tls-client-64.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_strxor.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD4.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_cpuid_c.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA384.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des3.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_poly1305.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ed448.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ctr.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA224.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_x25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA1.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA512.pydJump to dropped file

    Boot Survival

    barindex
    Contains functionality to infect the boot sector
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i2_2_00007FFE014C2B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C8AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,2_2_00007FFE014C8AA0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF7361260A0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF7361260A0
    Source: C:\Users\user\Desktop\prank.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\prank.exeCode function: PyList_New,OpenSCManagerA,GetLastError,PyErr_SetFromWindowsErrWithFilename,EnumServicesStatusExW,GetLastError,free,malloc,EnumServicesStatusExW,PyUnicode_FromWideChar,PyUnicode_FromWideChar,Py_BuildValue,PyList_Append,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,2_2_00007FFE014C8170
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_chacha20.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_ARC4.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_RIPEMD160.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\win32\win32crypt.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA256.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_portable.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_keccak.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cast.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Protocol\_scrypt.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD2.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_arc2.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\psutil\_psutil_windows.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aesni.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ed25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ec_ws.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2s.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2b.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\python311.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Math\_modexp.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD5.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_clmul.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\tls_client\dependencies\tls-client-64.dllJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_strxor.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD4.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_cpuid_c.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA384.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des3.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_poly1305.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ed448.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ctr.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA224.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_x25519.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA1.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA512.pydJump to dropped file
    Source: C:\Users\user\Desktop\prank.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-16773
    Source: C:\Users\user\Desktop\prank.exeAPI coverage: 0.8 %
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137FC0 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF736137FC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736127B30 FindFirstFileExW,FindClose,0_2_00007FF736127B30
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736141F84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF736141F84
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736137FC0 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF736137FC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C2E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc,2_2_00007FFE014C2E70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C18C0 PyModule_Create2,getenv,RtlGetVersion,GetSystemInfo,InitializeCriticalSection,PyModule_GetState,PyErr_NewException,_Py_Dealloc,PyErr_NewException,PyModule_AddObject,PyErr_NewException,PyModule_AddObject,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,2_2_00007FFE014C18C0
    Source: prank.exe, 00000002.00000002.1888538364.0000028E11143000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1878074484.0000028E11140000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1879911724.0000028E11141000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868932109.0000028E1110B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1870194523.0000028E11131000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWYr
    Source: C:\Users\user\Desktop\prank.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613AD48 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73613AD48
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6CDB00 GetModuleHandleW,LoadLibraryW,GetProcAddress,AddAccessAllowedAce,GetProcAddress,AddAccessDeniedAce,GetProcAddress,AddAccessAllowedAceEx,GetProcAddress,AddMandatoryAce,GetProcAddress,AddAccessAllowedObjectAce,GetProcAddress,AddAccessDeniedAceEx,GetProcAddress,AddAccessDeniedObjectAce,GetProcAddress,AddAuditAccessAceEx,GetProcAddress,AddAuditAccessObjectAce,GetProcAddress,SetSecurityDescriptorControl,InitializeCriticalSection,TlsAlloc,DeleteCriticalSection,TlsFree,2_2_00007FFDFF6CDB00
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736143B90 GetProcessHeap,0_2_00007FF736143B90
    Source: C:\Users\user\Desktop\prank.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\prank.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73613AD48 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73613AD48
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73612BBB4 SetUnhandledExceptionFilter,0_2_00007FF73612BBB4
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73612B160 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF73612B160
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73612BA0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73612BA0C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9D63058 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFDF9D63058
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9D62A90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFDF9D62A90
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDF9E82135 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFDF9E82135
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6CF85C SetUnhandledExceptionFilter,2_2_00007FFDFF6CF85C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6CF674 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFDFF6CF674
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6CE55C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFDFF6CE55C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014CA050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE014CA050
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014CA978 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE014CA978
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0B0554 SetUnhandledExceptionFilter,2_2_00007FFE0C0B0554
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0AF768 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0C0AF768
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0C0B036C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0C0B036C
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CF845F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CF845F8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CF91960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0CF91960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CF91390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CF91390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0CFA1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CFA1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0CFB1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFB1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CFB1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFC1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0CFC1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFC1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CFC1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFD1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0CFD1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFD1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CFD1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFE1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0CFE1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0CFE1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0CFE1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E131960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0E131960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E131390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0E131390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E141960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0E141960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E141390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0E141390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E151960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0E151960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E151390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0E151390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E172E70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0E172E70
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0E173438 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0E173438
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EA71960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0EA71960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EA71390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0EA71390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB21390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0EB21390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB21960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0EB21960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0EB31390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0EB31960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB42FF8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE0EB42FF8
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE0EB425B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE0EB425B0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE101D1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE101D1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE101D1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE101D1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE101E1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE101E1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE101E1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE101E1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10231960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE10231960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10231390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE10231390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10241960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE10241960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10241390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE10241390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10252BC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE10252BC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10252600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE10252600
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10304650 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE10304650
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE10304080 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE10304080
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11071960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE11071960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11071390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE11071390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE110F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE110F1960
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE110F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE110F1390
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11513630 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE11513630
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE11513C00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE11513C00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE120C1A00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE120C1A00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE120C1430 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE120C1430
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126CAA98 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE126CAA98
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126CA050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE126CA050
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126E5CB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE126E5CB0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE126E6254 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE126E6254
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE12E114F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE12E114F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE12E11AC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE12E11AC0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE130C1460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE130C1460
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE130C1A30 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE130C1A30
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE13241530 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE13241530
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE13241B00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE13241B00
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE13310468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE13310468
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E52F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE148E52F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE148E4D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE148E4D20
    Source: C:\Users\user\Desktop\prank.exeProcess created: C:\Users\user\Desktop\prank.exe "C:\Users\user\Desktop\prank.exe"Jump to behavior
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6C7CD0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,2_2_00007FFDFF6C7CD0
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFDFF6C8B50 _PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,_PyArg_ParseTuple_SizeT,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,2_2_00007FFDFF6C8B50
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736149EE0 cpuid 0_2_00007FF736149EE0
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\certifi VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_ctypes.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_bz2.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_lzma.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\certifi VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\libcrypto-3.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\libffi-8.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\libssl-3.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_decimal.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\tls_client\dependencies\tls-client-64.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_hashlib.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_socket.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\select.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_ssl.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_uuid.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\_queue.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md.cp311-win_amd64.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md__mypyc.cp311-win_amd64.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\unicodedata.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ctr.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_strxor.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_strxor.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2s.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2s.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA1.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA1.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA256.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA256.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD5.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD5.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Protocol\_scrypt.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_cpuid_c.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_cpuid_c.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_portable.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_portable.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_clmul.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aesni.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32\win32crypt.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\win32 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\prank.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\psutil VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\psutil VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI73602\psutil VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\Desktop\log.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\windll\Messengers\Discord VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF73612B8F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF73612B8F0
    Source: C:\Users\user\Desktop\prank.exeCode function: 0_2_00007FF736146410 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF736146410
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE014C18C0 PyModule_Create2,getenv,RtlGetVersion,GetSystemInfo,InitializeCriticalSection,PyModule_GetState,PyErr_NewException,_Py_Dealloc,PyErr_NewException,PyModule_AddObject,PyErr_NewException,PyModule_AddObject,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,2_2_00007FFE014C18C0

    Stealing of Sensitive Information

    barindex
    Yara detected Discord Token Stealer
    Source: Yara matchFile source: Process Memory Space: prank.exe PID: 7456, type: MEMORYSTR
    Tries to harvest and steal browser information (history, passwords, etc)
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10Jump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pingsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.defaultJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-releaseJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idbJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareportingJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backupsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removedJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_stateJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storageJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackupsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.filesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporaryJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmpJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.filesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pingsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.filesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\defaultJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.filesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archivedJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\dbJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\eventsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.filesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.filesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanentJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumpsJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chromeJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
    Source: C:\Users\user\Desktop\prank.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\gleanJump to behavior

    Remote Access Functionality

    barindex
    Yara detected Discord Token Stealer
    Source: Yara matchFile source: Process Memory Space: prank.exe PID: 7456, type: MEMORYSTR
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE102545E4 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,2_2_00007FFE102545E4
    Source: C:\Users\user\Desktop\prank.exeCode function: 2_2_00007FFE1025560C _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,2_2_00007FFE1025560C

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
    Service Execution    		1
    Windows Service    		1
    Access Token Manipulation    		1
    Masquerading    		1
    OS Credential Dumping    		2
    System Time Discovery    		Remote Services11
    Archive Collected Data    		2
    Encrypted Channel    		Exfiltration Over Other Network Medium1
    Data Encrypted for Impact
    CredentialsDomainsDefault Accounts2
    Native API    		1
    Bootkit    		1
    Windows Service    		1
    Access Token Manipulation    		LSASS Memory21
    Security Software Discovery    		Remote Desktop Protocol1
    Data from Local System    		1
    Ingress Tool Transfer    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAt1
    DLL Side-Loading    		11
    Process Injection    		11
    Process Injection    		Security Account Manager2
    Process Discovery    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
    DLL Side-Loading    		1
    Deobfuscate/Decode Files or Information    		NTDS1
    System Service Discovery    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
    Obfuscated Files or Information    		LSA Secrets2
    File and Directory Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    Bootkit    		Cached Domain Credentials25
    System Information Discovery    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
    Install Root Certificate    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
    Timestomp    		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
    DLL Side-Loading    		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    prank.exe67%ReversingLabsWin64.Trojan.Disco
    prank.exe58%VirustotalBrowse
    prank.exe100%AviraTR/Redcap.ijygn

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_ARC4.pyd1%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pyd3%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_chacha20.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_pkcs1_decode.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aesni.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_arc2.pyd1%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_blowfish.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cast.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pyd3%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ctr.pyd1%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des.pyd3%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des3.pyd1%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pyd2%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_eksblowfish.pyd0%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pyd3%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pyd3%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2b.pyd1%VirustotalBrowse

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    bg.microsoft.map.fastly.net0%VirustotalBrowse
    fp2e7a.wpc.phicdn.net0%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    https://www.ebay.co.uk/0%URL Reputationsafe
    http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%URL Reputationsafe
    https://bugzilla.mo0%URL Reputationsafe
    https://foss.heptapod.net/pypy/pypy/-/issues/35390%URL Reputationsafe
    http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html0%URL Reputationsafe
    https://account.bellmedia.c0%URL Reputationsafe
    http://cacerts.digicert.co0%URL Reputationsafe
    https://www.amazon.co.uk/0%URL Reputationsafe
    http://www.tarsnap.com/scrypt/scrypt-slides.pdf0%URL Reputationsafe
    https://discord.com/0%Avira URL Cloudsafe
    https://xvirus.lol100%Avira URL Cloudmalware
    https://discord.com/api/v9/users/0%Avira URL Cloudsafe
    https://discord.com0%Avira URL Cloudsafe
    https://discord.com/api/v9/invites/0%Avira URL Cloudsafe
    https://www.bbc.co.uk/0%Avira URL Cloudsafe
    https://paste-pgpj.onrender.com/?p=r0%Avira URL Cloudsafe
    https://discord.com/0%VirustotalBrowse
    http://html4/loose.dtd0%Avira URL Cloudsafe
    https://discord.com/api/v9/invites/0%VirustotalBrowse
    https://discord.com/api/v9/users/0%VirustotalBrowse
    https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
    https://www.bbc.co.uk/0%VirustotalBrowse
    https://xvirus.lol2%VirustotalBrowse
    http://.../back.jpeg0%Avira URL Cloudsafe
    http://.css0%Avira URL Cloudsafe
    https://discord.com/z0%Avira URL Cloudsafe
    http://.jpg0%Avira URL Cloudsafe
    https://paste-pgpj.onrender.com/?p=r3%VirustotalBrowse
    https://paste-pgpj.onrender.com/?p=0%Avira URL Cloudsafe
    https://discord.com0%VirustotalBrowse
    https://discord.com/api/v6/users/0%Avira URL Cloudsafe
    https://discord.com/api/v9/channels/0%Avira URL Cloudsafe
    https://paste-pgpj.onrender.com/?p=1%VirustotalBrowse
    https://discord.com/z0%VirustotalBrowse
    https://discord.com/api/v9/channels/0%VirustotalBrowse
    https://discord.com/api/v6/users/0%VirustotalBrowse

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    bg.microsoft.map.fastly.net
    		199.232.210.172
    		truefalseunknown
    fp2e7a.wpc.phicdn.net
    		192.229.211.108
    		truefalseunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdfprank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892443749.0000028E374D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://www.avito.ru/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://github.com/giampaolo/psutil/issues/875.prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://github.com/mhammond/pywin32prank.exe, prank.exe, 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmp, prank.exe, 00000002.00000002.1905148694.00007FFDFF6E1000.00000002.00000001.01000000.0000002B.sdmpfalse
            		high
            https://www.ctrip.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://discord.com/prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpfalse
              • 0%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown
              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#prank.exe, 00000002.00000003.1869964239.0000028E0F35A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831560757.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887081651.0000028E0F362000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877413621.0000028E0F35E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827863298.0000028E0F36B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://www.leboncoin.fr/prank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://goo.gl/zeJZl.prank.exe, 00000002.00000003.1878543121.0000028E373AD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373AD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://tools.ietf.org/html/rfc2388#section-4.4prank.exe, 00000002.00000003.1880282584.0000028E11111000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1888321037.0000028E11119000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1883443720.0000028E11115000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868932109.0000028E1110B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881635914.0000028E11112000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64prank.exe, 00000002.00000003.1876786375.0000028E110DB000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1858604617.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847325256.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839252495.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842705396.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865421881.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863057950.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835206742.0000028E110CC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1840360496.0000028E110BC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868732851.0000028E110D3000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854674556.0000028E110BC000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://weibo.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://www.msn.comprank.exe, 00000002.00000002.1894830451.0000028E38594000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://discord.com/api/v9/users/prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                            • 0%, Virustotal, Browse
                            • Avira URL Cloud: safe
                            		unknown
                            https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963prank.exe, 00000002.00000002.1889895762.0000028E11510000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://tools.ietf.org/html/rfc3610prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892504829.0000028E374D8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E37338000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://peps.python.org/pep-0205/prank.exe, 00000002.00000003.1834416637.0000028E111DE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E11204000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E111E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835278362.0000028E11214000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://curl.haxx.se/rfc/cookie_spec.htmlprank.exe, 00000002.00000003.1834416637.0000028E111DE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E11204000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832937204.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833115817.0000028E11203000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E111E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833215036.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.reddit.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.amazon.ca/prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://discord.com/api/v9/invites/prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • 0%, Virustotal, Browse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyprank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688prank.exe, 00000002.00000002.1887268122.0000028E10C38000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.ebay.co.uk/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://httpbin.org/getprank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1879299367.0000028E3741D000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://discord.comprank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • 0%, Virustotal, Browse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://xvirus.lolprank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmptrue
                                              • 2%, Virustotal, Browse
                                              • Avira URL Cloud: malware
                                              		unknown
                                              https://www.ebay.de/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerprank.exe, 00000002.00000003.1869964239.0000028E0F35A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831560757.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887081651.0000028E0F362000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877413621.0000028E0F35E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827863298.0000028E0F36B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.amazon.com/prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/python/cpython/issues/86361.prank.exe, 00000002.00000003.1834797489.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832734511.0000028E111EE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832191401.0000028E1127B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1857004157.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873972307.0000028E11185000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854612279.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1880317278.0000028E1118B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E1116B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841805763.0000028E11173000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852177185.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872385003.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868223898.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1888860563.0000028E1118D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832668495.0000028E1127B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873728149.0000028E11182000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832357990.0000028E111ED000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://mail.python.org/pipermail/python-dev/2012-June/120787.html.prank.exe, 00000002.00000003.1865173014.0000028E1102B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873537357.0000028E1108E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1870998058.0000028E1107A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887906027.0000028E1108F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873015511.0000028E1107C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1882864369.0000028E1108F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1870608022.0000028E11043000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://httpbin.org/prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlprank.exe, 00000002.00000003.1831869208.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832079756.0000028E111CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832287020.0000028E11220000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831804483.0000028E11220000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brprank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.youtube.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://allegro.pl/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535prank.exe, 00000002.00000003.1875582380.0000028E37286000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1857004157.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854612279.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E3727B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876921072.0000028E37281000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841805763.0000028E11173000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852177185.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1891129141.0000028E37281000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872385003.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876435320.0000028E111D8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868223898.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872471401.0000028E111D1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875676996.0000028E37280000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3727B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syprank.exe, 00000002.00000003.1869964239.0000028E0F35A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831560757.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1887081651.0000028E0F362000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877413621.0000028E0F35E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827863298.0000028E0F36B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://MD8.mozilla.org/1/mprank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E38574000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.python.org/psf/license/prank.exe, 00000002.00000002.1902775572.00007FFDFB918000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drfalse
                                                                        		high
                                                                        https://www.bbc.co.uk/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        • 0%, Virustotal, Browse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        http://wwwsearch.sf.net/):prank.exe, 00000002.00000003.1834797489.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832937204.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1857004157.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833115817.0000028E11203000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854612279.0000028E11179000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833333607.0000028E1116B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1833215036.0000028E1128C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841805763.0000028E11173000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852177185.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872385003.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868223898.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1880991799.0000028E1117B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834223361.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://bugzilla.moprank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://paste-pgpj.onrender.com/?p=rprank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • 3%, Virustotal, Browse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://google.com/mailprank.exe, 00000002.00000003.1874695603.0000028E37400000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872831800.0000028E110FE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872955913.0000028E373FD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyprank.exe, 00000002.00000003.1827839835.0000028E10FF1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmprank.exe, 00000002.00000003.1831869208.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832079756.0000028E111CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832287020.0000028E11220000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832390054.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831804483.0000028E11220000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.rfc-editor.org/info/rfc7253prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.google.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyRprank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://www.iqiyi.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdfprank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892504829.0000028E374D8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E37338000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://foss.heptapod.net/pypy/pypy/-/issues/3539prank.exe, 00000002.00000002.1889895762.0000028E11510000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.prank.exe, 00000002.00000003.1874695603.0000028E373EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875951043.0000028E373F8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873577136.0000028E373ED000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://google.com/prank.exe, 00000002.00000003.1872915494.0000028E373CE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874410084.0000028E373D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://html4/loose.dtdprank.exe, 00000002.00000002.1899769918.00007FFDFA798000.00000008.00000001.01000000.0000000C.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		low
                                                                                                https://mahler:8092/site-updates.pyprank.exe, 00000002.00000003.1879261481.0000028E112C0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834124515.0000028E112A1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835236998.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834557973.0000028E110DA000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834194794.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889638171.0000028E112D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866442063.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875151604.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868799090.0000028E112B0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877687073.0000028E112C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		low
                                                                                                https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDFprank.exe, 00000002.00000003.1848733307.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848235650.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E3754F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1852719797.0000028E37EA7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://.../back.jpegprank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		low
                                                                                                  http://tools.ietf.org/html/rfc5869prank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868480615.0000028E374C1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872343544.0000028E374C5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892411230.0000028E374C7000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://www.python.org/download/releases/2.3/mro/.prank.exe, 00000002.00000002.1887268122.0000028E10BB0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1828848874.0000028E1104E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.htmlprank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E3735E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E374F8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E374E8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://httpbin.org/postprank.exe, 00000002.00000003.1851513864.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875244927.0000028E37320000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://github.com/Ousret/charset_normalizerprank.exe, 00000002.00000003.1880799015.0000028E37424000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1869303294.0000028E37424000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863577290.0000028E3740A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866672361.0000028E37423000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1891807486.0000028E37424000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1879299367.0000028E37424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/urllib3/urllib3/issues/2920prank.exe, 00000002.00000002.1893023054.0000028E37670000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://.cssprank.exe, 00000002.00000002.1899769918.00007FFDFA798000.00000008.00000001.01000000.0000000C.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		low
                                                                                                            https://github.com/psf/requests)prank.exe, 00000002.00000003.1873786178.0000028E11160000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862842305.0000028E1117A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832390054.0000028E111E6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://yahoo.com/prank.exe, 00000002.00000003.1874695603.0000028E37400000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872831800.0000028E110FE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872955913.0000028E373FD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://account.bellmedia.cprank.exe, 00000002.00000002.1894830451.0000028E38594000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                • URL Reputation: safe
                                                                                                                		unknown
                                                                                                                http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6prank.exe, 00000002.00000003.1867104727.0000028E37341000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E37342000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E37338000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871784714.0000028E37342000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://login.microsoftonline.comprank.exe, 00000002.00000003.1881868457.0000028E37CD0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E38584000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://cacerts.digicert.coprank.exe, 00000000.00000003.1813724673.00000230F6A78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://html.spec.whatwg.org/multipage/prank.exe, 00000002.00000003.1875705420.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1876712755.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873823517.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1869829394.0000028E0F304000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1886735277.0000028E0F30B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871735777.0000028E0F30A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.ifeng.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsprank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.zhihu.com/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://discord.com/zprank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdfprank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E3735E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867685704.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1867104727.0000028E3734D000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866442063.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875151604.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871500525.0000028E3735B000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868799090.0000028E112B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://www.iana.org/time-zones/repository/tz-link.htmlprank.exe, 00000002.00000003.1831869208.0000028E11172000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1832287020.0000028E11220000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1831804483.0000028E11220000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://tools.ietf.org/html/rfc5297prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://tools.ietf.org/html/rfc4880prank.exe, 00000002.00000003.1872915494.0000028E373CE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874937040.0000028E110FA000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874410084.0000028E373D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://requests.readthedocs.ioprank.exe, 00000002.00000003.1851513864.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875244927.0000028E37320000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://.jpgprank.exe, 00000002.00000002.1899769918.00007FFDFA798000.00000008.00000001.01000000.0000000C.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		low
                                                                                                                                      http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdfprank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866132874.0000028E374D6000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874258446.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892375396.0000028E374B8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://www.python.orgprank.exe, 00000002.00000003.1851513864.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E372EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875244927.0000028E37320000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://www.amazon.co.uk/prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          		unknown
                                                                                                                                          http://www.tarsnap.com/scrypt/scrypt-slides.pdfprank.exe, 00000002.00000003.1838117397.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842153540.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1850851159.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839930528.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1892443749.0000028E374D2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1855995167.0000028E37484000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838785972.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1848733307.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1847428605.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849218484.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853345273.0000028E37487000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865870268.0000028E374BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1865946089.0000028E374D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864071382.0000028E37491000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862497217.0000028E37485000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843492437.0000028E37487000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          		unknown
                                                                                                                                          https://paste-pgpj.onrender.com/?p=prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          • 1%, Virustotal, Browse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfprank.exe, 00000002.00000003.1854431481.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872915494.0000028E373CE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874695603.0000028E37400000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893254809.0000028E37780000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1890787483.0000028E37160000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1871949297.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E37438000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1891768614.0000028E37404000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866013953.0000028E37441000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://discord.com/api/v6/users/prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://www.python.org/prank.exe, 00000002.00000003.1879261481.0000028E112C0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875275166.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872775981.0000028E112B2000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866235904.0000028E1126A000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834124515.0000028E112A1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835206742.0000028E110CC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1835236998.0000028E112BD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834557973.0000028E110DA000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834194794.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889638171.0000028E112D0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862746912.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E11265000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866442063.0000028E112A5000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875151604.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1834797489.0000028E112B4000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868799090.0000028E112B0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1877687073.0000028E112C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://json.orgprank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://www.wykop.pl/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1893519439.0000028E378C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://twitter.com/prank.exe, 00000002.00000003.1864676927.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1856879978.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1868588639.0000028E11229000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1838117397.0000028E373BE000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1854501143.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1839076054.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1874410084.0000028E373E1000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1849423557.0000028E11223000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841505165.0000028E1121C000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://stackoverflow.com/questions/4457745#4457745.prank.exe, 00000002.00000002.1893679221.0000028E37A00000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://discord.com/api/v9/channels/prank.exe, 00000002.00000003.1835206742.0000028E110CC000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1889802548.0000028E11410000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1862678862.0000028E0F349000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • 0%, Virustotal, Browse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.olx.pl/prank.exe, 00000002.00000003.1881868457.0000028E37C04000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E3851C000.00000004.00001000.00020000.00000000.sdmp, prank.exe, 00000002.00000002.1894830451.0000028E384F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://support.mozilla.org/products/firefoxprank.exe, 00000002.00000003.1874695603.0000028E373EF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E3757F000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1851513864.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1872587202.0000028E373E0000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1863178930.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1853707872.0000028E373CD000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1866948185.0000028E373DF000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1875951043.0000028E373F8000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1843340742.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1873577136.0000028E373ED000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1841936589.0000028E37595000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1842705396.0000028E1109E000.00000004.00000020.00020000.00000000.sdmp, prank.exe, 00000002.00000003.1864785994.0000028E373CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high

                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                          ⊘No contacted IP infos

                                                                                                                                                          General Information

                                                                                                                                                          Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                          Analysis ID:1423651
                                                                                                                                                          Start date and time:2024-04-10 08:36:10 +02:00
                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                          Overall analysis duration:0h 7m 13s
                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                          Report type:full
                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                          Number of analysed new started processes analysed:6
                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                          Number of injected processes analysed:0
                                                                                                                                                          Technologies:
                                                                                                                                                          • HCA enabled
                                                                                                                                                          • EGA enabled
                                                                                                                                                          • AMSI enabled
                                                                                                                                                          Analysis Mode:default
                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                          Sample name:prank.exe
                                                                                                                                                          Detection:MAL
                                                                                                                                                          Classification:mal84.troj.spyw.winEXE@4/69@0/0
                                                                                                                                                          EGA Information:
                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                          HCA Information:Failed
                                                                                                                                                          Cookbook Comments:
                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                          • Stop behavior analysis, all processes terminated

                                                                                                                                                          Warnings

                                                                                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
                                                                                                                                                          • Excluded IPs from analysis (whitelisted): 20.190.190.195, 40.126.62.132, 20.190.190.194, 40.126.62.131, 20.190.190.132, 20.190.190.130, 20.190.190.131, 40.126.62.129, 13.89.179.12
                                                                                                                                                          • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, onedsblobprdcus17.centralus.cloudapp.azure.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

                                                                                                                                                          Simulations

                                                                                                                                                          Behavior and APIs

                                                                                                                                                          ⊘No simulations

                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                          IPs

                                                                                                                                                          ⊘No context

                                                                                                                                                          Domains

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                          fp2e7a.wpc.phicdn.nethttps://fortyunder40africa.com/well.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://in-vr49799.lt.acemlnb.com/prod/link-tracker?redirecturl=ahr0chmlm0elmkylmkz3d3cubmv0emvyb2npcmnszs5vcmc=&sig=5awcgjccgq8shwqwdyi1ygkpesim6t6npcasuqu4kdsh&iat=1712669277&a=%7c%7c612730296%7c%7c&account=in-vr49799.activehosted.com&email=q6gkayf6c8h9zf%2f9eoy65kio9yiqpztomvafruiitbdms5urciaa%3aqeo1dhox3tnuykvjctdb5b%2bkfrqbwgek&s=4a5f8e8209e7fb5012def13359a3eb6c&i=403a1286a71a4286Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://in-vr49799.lt.acemlnb.com/prod/link-tracker?redirecturl=ahr0chmlm0elmkylmkz3d3cubmv0emvyb2npcmnszs5vcmclmkzyzwnlchrpb24lmkzyzwdpc3rlci15b3vylwludgvyzxn0&sig=9ra8lnygcad1drpw1ufrndsffk6ugpxb9k9gpcbw2b57&iat=1712669277&a=%7c%7c612730296%7c%7c&account=in-vr49799.activehosted.com&email=q6gkayf6c8h9zf%2f9eoy65kio9yiqpztomvafruiitbdms5urciaa%3aqeo1dhox3tnuykvjctdb5b%2bkfrqbwgek&s=4a5f8e8209e7fb5012def13359a3eb6c&i=403a1286a71a4285Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://checking-browser.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://docs.google.com/presentation/d/e/2PACX-1vSISBvuqQ3avVKYEsJWbziIGKe8YAwJzN9v0eLr650MtXPM79gcGg118clXySbSZRcxjBZkqhP582Ln/pub?start=false&loop=false&delayms=3000Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          http://www.acrossamericainsurance.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://noisesperusemotel.comGet hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://att-log6988.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          https://08.172-245-112-195.cprapid.com/Postelnfo/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                          • 192.229.211.108
                                                                                                                                                          bg.microsoft.map.fastly.nethttps://fortyunder40africa.com/well.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.210.172
                                                                                                                                                          https://in-vr49799.lt.acemlnb.com/prod/link-tracker?redirecturl=ahr0chmlm0elmkylmkz3d3cubmv0emvyb2npcmnszs5vcmc=&sig=5awcgjccgq8shwqwdyi1ygkpesim6t6npcasuqu4kdsh&iat=1712669277&a=%7c%7c612730296%7c%7c&account=in-vr49799.activehosted.com&email=q6gkayf6c8h9zf%2f9eoy65kio9yiqpztomvafruiitbdms5urciaa%3aqeo1dhox3tnuykvjctdb5b%2bkfrqbwgek&s=4a5f8e8209e7fb5012def13359a3eb6c&i=403a1286a71a4286Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.210.172
                                                                                                                                                          1fe0b1c0000.dll.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.214.172
                                                                                                                                                          https://noisesperusemotel.comGet hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.214.172
                                                                                                                                                          https://att-log6988.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.210.172
                                                                                                                                                          https://08.172-245-112-195.cprapid.com/Postelnfo/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                          • 199.232.214.172
                                                                                                                                                          https://metamask.com-do.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.210.172
                                                                                                                                                          https://yda482.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.214.172
                                                                                                                                                          https://dncdeytzt4gzdb.azureedge.net/003/?Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.210.172
                                                                                                                                                          https://ece894.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                          • 199.232.214.172

                                                                                                                                                          ASNs

                                                                                                                                                          ⊘No context

                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                          ⊘No context

                                                                                                                                                          Dropped Files

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pydSecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                              SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                  MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousPython StealerBrowse
                                                                                                                                                                    SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                      SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                        SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          SecuriteInfo.com.Trojan.GenericKD.70641791.20493.31768.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                                                                                                            SecuriteInfo.com.Win64.Evo-gen.8168.21888.exeGet hashmaliciousPython Stealer, MicroClipBrowse
                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_ARC4.pydSecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                    MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                          SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                            SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              SecuriteInfo.com.Trojan.GenericKD.70641791.20493.31768.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                                                                                                                                SecuriteInfo.com.Win64.Evo-gen.8168.21888.exeGet hashmaliciousPython Stealer, MicroClipBrowse

                                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):11264
                                                                                                                                                                                                  Entropy (8bit):4.6989965032233245
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:96:v9VD9daQ2iTrqT+y/ThvQ0I1uLfcC75JiC4Rs89EcYyGDPM0OcX6gY/7ECFV:39damqT3ThITst0E5DPKcqgY/79X
                                                                                                                                                                                                  MD5:56976443600793FF2302EE7634E496B3
                                                                                                                                                                                                  SHA1:018CE9250732A1794BBD0BDB8164061022B067AA
                                                                                                                                                                                                  SHA-256:10F461A94C3D616C19FF1A88DEC1EFEA5194F7150F5D490B38AC4E1B31F673DD
                                                                                                                                                                                                  SHA-512:A764C636D5D0B878B91DC61485E8699D7AA36F09AA1F0BD6AF33A8652098F28AEB3D7055008E56EBFC012BD3EA0868242A72E44DED0C83926F13D16866C31415
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                  Joe Sandbox View:
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.Trojan.GenericKD.70641791.20493.31768.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.Win64.Evo-gen.8168.21888.exe, Detection: malicious, Browse
                                                                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):13824
                                                                                                                                                                                                  Entropy (8bit):5.047528837102683
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:SF/1nb2eqCQtkluknuz4ceS4QDuEA7cqgYvEP:o2P6luLtn4QDHmgYvEP
                                                                                                                                                                                                  MD5:30F13366926DDC878B6D761BEC41879E
                                                                                                                                                                                                  SHA1:4B98075CCBF72A6CBF882B6C5CADEF8DC6EC91DB
                                                                                                                                                                                                  SHA-256:19D5F8081552A8AAFE901601D1FF5C054869308CEF92D03BCBE7BD2BB1291F23
                                                                                                                                                                                                  SHA-512:BDCEC85915AB6EC1D37C1D36B075AE2E69AA638B80CD08971D5FDFD9474B4D1CF442ABF8E93AA991F5A8DCF6DB9D79FB67A9FE7148581E6910D9C952A5E166B4
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                  Joe Sandbox View:
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.Trojan.GenericKD.70641791.20493.31768.exe, Detection: malicious, Browse
                                                                                                                                                                                                  • Filename: SecuriteInfo.com.Win64.Evo-gen.8168.21888.exe, Detection: malicious, Browse
                                                                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):13312
                                                                                                                                                                                                  Entropy (8bit):5.0513840905718395
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:7XF/1nb2eqCQtkXnFYIrWjz0YgWDbu5Do0vdvZt49lkVcqgYvEMN:L2P6XTr0zXgWDbui0vdvZt49MgYvEMN
                                                                                                                                                                                                  MD5:CDF7D583B5C0150455BD3DAD43A6BF9B
                                                                                                                                                                                                  SHA1:9EE9B033892BEB0E9641A67F456975A78122E4FA
                                                                                                                                                                                                  SHA-256:4CA725A1CB10672EE5666ED2B18E926CAAE1A8D8722C14AB3BE2D84BABF646F6
                                                                                                                                                                                                  SHA-512:96123559D21A61B144E2989F96F16786C4E94E5FA4DDA0C018EAA7FEFFA61DD6F0ADFA9815DF9D224CDEBE2E7849376D2A79D5A0F51A7F3327A2FAA0A444CE9C
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):12800
                                                                                                                                                                                                  Entropy (8bit):5.1050594710160535
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:96:/PTF1siKeai1dqmJo0qVVLf/+NJSC6sc9kJ9oPobXXXP4IIYOxDmO8jcX6gRth2h:/LsiHfq5poUkJ97zIDmOucqgRvE
                                                                                                                                                                                                  MD5:7918BFE07DCB7AD21822DBAAA777566D
                                                                                                                                                                                                  SHA1:964F5B172759538C4E9E9131CE4BB39885D79842
                                                                                                                                                                                                  SHA-256:C00840D02ADA7031D294B1AB94A5F630C813AAE6897F18DD66C731F56931868E
                                                                                                                                                                                                  SHA-512:D4A05AB632D4F0EB0ED505D803F6A5C0DBE5117D12BA001CE820674903209F7249B690618555F9C061DB58BED1E03BE58AD5D5FE3BC35FC96DF27635639ABF25
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l......l.q.m...l..m...l...m...l.q.i...l.q.h...l.q.o...l...d...l...l...l.......l...n...l.Rich..l.................PE..d....y.e.........." ...#............P.....................................................`.........................................P8..p....8..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):36352
                                                                                                                                                                                                  Entropy (8bit):6.55587798283519
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:Of+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg4HPy:WqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                  MD5:4B032DA3C65EA0CFBDEB8610C4298C51
                                                                                                                                                                                                  SHA1:541F9F8D428F4518F96D44BB1037BC348EAE54CF
                                                                                                                                                                                                  SHA-256:4AEF77E1359439748E6D3DB1ADB531CF86F4E1A8E437CCD06E8414E83CA28900
                                                                                                                                                                                                  SHA-512:2667BF25FD3BF81374750B43AFC5AEFF839EC1FF6DFC3FDD662F1D34A5924F69FC513EA3CD310991F85902A19ADA8B58DED9A9ED7B5D631563F62EA7F2624102
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):15872
                                                                                                                                                                                                  Entropy (8bit):5.2919328525651945
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:oJBjJPqZkEPYinXKccxrEWx4xLquhS3WQ67EIfD4A1ccqgwYUMvEW:6URwin7mrEYCLEGd7/fDnwgwYUMvE
                                                                                                                                                                                                  MD5:57E4DF965E41B1F385B02F00EA08AE20
                                                                                                                                                                                                  SHA1:583B08C3FC312C8943FECDDD67D6D0A5FC2FF98B
                                                                                                                                                                                                  SHA-256:3F64DFFEC486DCF9A2E80CB9D96251B98F08795D5922D43FB69F0A5AC2340FC2
                                                                                                                                                                                                  SHA-512:48C3F78AF4E35BFEF3B0023A8039CF83E6B2E496845A11B7A2C2FA8BB62C7CCDE52158D4D37755584716220C34BBF379ECE7F8E3439B009AD099B1890B42A3D9
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|X...................i.......................i.......i.......i.......................................Rich....................PE..d....y.e.........." ...#. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):16384
                                                                                                                                                                                                  Entropy (8bit):5.565187477275172
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:MeDd9Vk3yQ5f8vjVKChhXoJDkq6NS7oE2DDHlWw2XpmdcqgwNeecBU8:1k/5cj4shXED+o2Du8zgwNeO8
                                                                                                                                                                                                  MD5:F9C93FA6CA17FDF4FF2F13176684FD6C
                                                                                                                                                                                                  SHA1:6B6422B4CAF157147F7C0DD4B4BAB2374BE31502
                                                                                                                                                                                                  SHA-256:E9AEBB6F17BA05603E0763DFF1A91CE9D175C61C1C2E80F0881A0DEE8CFFBE3A
                                                                                                                                                                                                  SHA-512:09843E40E0D861A2DEE97320779C603550433BC9AB9402052EA284C6C74909E17CE0F6D3FDBA983F5EB6E120E2FE0C2B087420E138760BB0716D2999C10935C1
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):20992
                                                                                                                                                                                                  Entropy (8bit):6.058843128972375
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:fHU/5cJMOZA0nmwBD+XpJgLa0Mp8Qhg4P2llyM:QK1XBD+DgLa1qTi
                                                                                                                                                                                                  MD5:E4969D864420FEB94F54CEF173D0AD4D
                                                                                                                                                                                                  SHA1:7F8FE4225BB6FD37F84EBCE8E64DF7192BA50FB6
                                                                                                                                                                                                  SHA-256:94D7D7B43E58170CAEA4520D7F741D743BC82B59BE50AA37D3D2FB7B8F1BB061
                                                                                                                                                                                                  SHA-512:F02F02A7DE647DDA723A344DBB043B75DA54D0783AE13E5D25EEC83072EA3B2375F672B710D6348D9FC829E30F8313FA44D5C28B4D65FDA8BB863700CAE994B7
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):25088
                                                                                                                                                                                                  Entropy (8bit):6.458942954966616
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:xVcaHLHm+kJ7ZXmrfXA+UA10ol31tuXyZQ7gLWi:8aHrm+kJNXmrXA+NNxWi28LWi
                                                                                                                                                                                                  MD5:CD4B96612DEFDAAC5CF923A3960F15B6
                                                                                                                                                                                                  SHA1:3F987086C05A4246D8CCA9A65E42523440C7FFEC
                                                                                                                                                                                                  SHA-256:5C25283C95FFF9B0E81FCC76614626EB8048EA3B3FD1CD89FE7E2689130E0447
                                                                                                                                                                                                  SHA-512:C650860A3ECC852A25839FF1E379526157EB79D4F158B361C90077875B757F5E7A4AA33FFE5F4F49B28DF5D60E3471370889FBE3BF4D9568474ECE511FF5E67D
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....".......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):12288
                                                                                                                                                                                                  Entropy (8bit):4.833693880012467
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:BF/1nb2eqCQtkrAUj8OxKbDbzecqgYvEkrK:t2P6EE8OsbD2gYvEmK
                                                                                                                                                                                                  MD5:0C46D7B7CD00B3D474417DE5D6229C41
                                                                                                                                                                                                  SHA1:825BDB1EA8BBFE7DE69487B76ABB36196B5FDAC0
                                                                                                                                                                                                  SHA-256:9D0A5C9813AD6BA129CAFEF815741636336EB9426AC4204DE7BC0471F7B006E1
                                                                                                                                                                                                  SHA-512:D81B17B100A052899D1FD4F8CEA1B1919F907DAA52F1BAD8DC8E3F5AFC230A5BCA465BBAC2E45960E7F8072E51FDD86C00416D06CF2A1F07DB5AD8A4E3930864
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):13824
                                                                                                                                                                                                  Entropy (8bit):4.900216636767426
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:YTI1RgPfqLlvIOP3bdS2hkPUDk9oCM/vPXcqgzQkvEmO:YTvYgAdDkUDDCWpgzQkvE
                                                                                                                                                                                                  MD5:3142C93A6D9393F071AB489478E16B86
                                                                                                                                                                                                  SHA1:4FE99C817ED3BCC7708A6631F100862EBDA2B33D
                                                                                                                                                                                                  SHA-256:5EA310E0F85316C8981ED6293086A952FA91A6D12CA3F8AF9581521EE2B15586
                                                                                                                                                                                                  SHA-512:DCAFEC54BD9F9F42042E6FA4AC5ED53FEB6CF8D56ADA6A1787CAFC3736AA72F14912BBD1B27D0AF87E79A6D406B0326602ECD1AD394ACDC6275AED4C41CDB9EF
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):14848
                                                                                                                                                                                                  Entropy (8bit):5.302400096950382
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:SJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDr+DjRcqgUF6+6vEX:6E1si8NSixS0CqebtD+rgUUjvE
                                                                                                                                                                                                  MD5:A34F499EE5F1B69FC4FED692A5AFD3D6
                                                                                                                                                                                                  SHA1:6A37A35D4F5F772DAB18E1C2A51BE756DF16319A
                                                                                                                                                                                                  SHA-256:4F74BCF6CC81BAC37EA24CB1EF0B17F26B23EDB77F605531857EAA7B07D6C8B2
                                                                                                                                                                                                  SHA-512:301F7C31DEE8FF65BB11196F255122E47F3F1B6B592C86B6EC51AB7D9AC8926FECFBE274679AD4F383199378E47482B2DB707E09D73692BEE5E4EC79C244E3A8
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,......,.q.-...,..-...,...-...,.q.)...,.q.(...,.q./...,...$...,...,...,.......,.......,.Rich..,.................PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):57856
                                                                                                                                                                                                  Entropy (8bit):4.25844209931351
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:1UqVT1dZ/lHkJnYcZiGKdZHDLtiduprZAZB0JAIg+v:nHlHfJid3X
                                                                                                                                                                                                  MD5:007BE822C3657687A84A7596531D79B7
                                                                                                                                                                                                  SHA1:B24F74FDC6FA04EB7C4D1CD7C757C8F1C08D4674
                                                                                                                                                                                                  SHA-256:6CF2B3969E44C88B34FB145166ACCCDE02B53B46949A9D5C37D83CA9C921B8C8
                                                                                                                                                                                                  SHA-512:F9A8B070302BDFE39D0CD8D3E779BB16C9278AE207F5FADF5B27E1A69C088EEF272BFBCE6B977BA37F68183C8BBEAC7A31668662178EFE4DF8940E19FBCD9909
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):58368
                                                                                                                                                                                                  Entropy (8bit):4.274890605099198
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:4Uqho9weF5/dHkRnYcZiGKdZHDL7idErZBZYmGg:ECndH//iduz
                                                                                                                                                                                                  MD5:A883798D95F76DA8513DA6B87D470A2A
                                                                                                                                                                                                  SHA1:0507D920C1935CE71461CA1982CDB8077DDB3413
                                                                                                                                                                                                  SHA-256:AED194DD10B1B68493481E7E89F0B088EF216AB5DB81959A94D14BB134643BFB
                                                                                                                                                                                                  SHA-512:5C65221542B3849CDFBC719A54678BB414E71DE4320196D608E363EFF69F2448520E620B5AA8398592D5B58D7F7EC1CC4C72652AD621308C398D45F294D05C9B
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):10752
                                                                                                                                                                                                  Entropy (8bit):4.5811635662773185
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:PzWVddiTHThQTctEEI4qXDc1CkcqgbW6:PzWMdsc+EuXDc0YgbW
                                                                                                                                                                                                  MD5:DEDAE3EFDA452BAB95F69CAE7AEBB409
                                                                                                                                                                                                  SHA1:520F3D02693D7013EA60D51A605212EFED9CA46B
                                                                                                                                                                                                  SHA-256:6248FDF98F949D87D52232DDF61FADA5EF02CD3E404BB222D7541A84A3B07B8A
                                                                                                                                                                                                  SHA-512:8C1CAB8F34DE2623A42F0750F182B6B9A7E2AFFA2667912B3660AF620C7D9AD3BD5B46867B3C2D50C0CAE2A1BC03D03E20E4020B7BA0F313B6A599726F022C6C
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 2%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):22016
                                                                                                                                                                                                  Entropy (8bit):6.1405490084747445
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:WMU/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8Qg0gYP2lcCM:WdKR8EbxwKflDFQgLa1AzP
                                                                                                                                                                                                  MD5:914EA1707EBA03E4BE45D3662BF2466E
                                                                                                                                                                                                  SHA1:3E110C9DBFE1D17E1B4BE69052E65C93DDC0BF26
                                                                                                                                                                                                  SHA-256:4D4F22633D5DB0AF58EE260B5233D48B54A6F531FFD58EE98A5305E37A00D376
                                                                                                                                                                                                  SHA-512:F6E6323655B351E5B7157231E04C352A488B0B49D7174855FC8594F119C87A26D31C602B3307C587A28AD408C2909A93B8BA8CB41166D0113BD5C6710C4162C3
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):17920
                                                                                                                                                                                                  Entropy (8bit):5.350740516564008
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:GPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD88g6Vf4A:APcnB8KEsB3ocb+pcOYLMCBDu
                                                                                                                                                                                                  MD5:52E481A15C3CE1B0DF8BA3B1B77DF9D0
                                                                                                                                                                                                  SHA1:C1F06E1E956DFDE0F89C2E237ADFE42075AAE954
                                                                                                                                                                                                  SHA-256:C85A6783557D96BFA6E49FE2F6EA4D2450CF110DA314C6B8DCEDD7590046879B
                                                                                                                                                                                                  SHA-512:108FB1344347F0BC27B4D02D3F4E75A76E44DE26EF54323CB2737604DF8860A94FA37121623A627937F452B3B923C3D9671B13102D2E5F1005E4766E80A05A96
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):12288
                                                                                                                                                                                                  Entropy (8bit):4.737329240938157
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:BF/1nb2eqCQtkgU7L9D0T70fcqgYvEJPb:t2P6L9DWAxgYvEJj
                                                                                                                                                                                                  MD5:A13584F663393F382C6D8D5C0023BC80
                                                                                                                                                                                                  SHA1:D324D5FBD7A5DBA27AA9B0BDB5C2AEBFF17B55B1
                                                                                                                                                                                                  SHA-256:13C34A25D10C42C6A12D214B2D027E5DC4AE7253B83F21FD70A091FEDAC1E049
                                                                                                                                                                                                  SHA-512:14E4A6F2959BD68F441AA02A4E374740B1657AB1308783A34D588717F637611724BC90A73C80FC6B47BC48DAFB15CF2399DC7020515848F51072F29E4A8B4451
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):14848
                                                                                                                                                                                                  Entropy (8bit):5.2072665819239585
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:iF/1nb2eqCQtkhlgJ2ycxFzShJD9CAac2QDeJKcqgQx2XY:Y2PKr+2j8JDefJagQx2XY
                                                                                                                                                                                                  MD5:104B480CB83BFF78101CF6940588D570
                                                                                                                                                                                                  SHA1:6FC56B9CF380B508B01CAB342FCC939494D1F595
                                                                                                                                                                                                  SHA-256:BA4F23BBDD1167B5724C04DB116A1305C687001FAC43304CD5119C44C3BA6588
                                                                                                                                                                                                  SHA-512:60617865C67115AD070BD6462B346B89B69F834CAF2BFE0EF315FB4296B833E095CD03F3F4D6D9499245C5DA8785F2FBE1AC7427049BD48428EBF74529229040
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...~y.e.........." ...#..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):14336
                                                                                                                                                                                                  Entropy (8bit):5.177411248432731
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:mF/1nb2eqCQt7fSxp/CJPvADQZntxSOvbcqgEvcM+:c2PNKxZWPIDexVlgEvL
                                                                                                                                                                                                  MD5:06D3E941860BB0ABEDF1BAF1385D9445
                                                                                                                                                                                                  SHA1:E8C16C3E8956BA99A2D0DE860DCFC5021F1D7DE5
                                                                                                                                                                                                  SHA-256:1C340D2625DAD4F07B88BB04A81D5002AABF429561C92399B0EB8F6A72432325
                                                                                                                                                                                                  SHA-512:6F62ACFF39B77C1EC9F161A9BFA94F8E3B932D56E63DAEE0093C041543993B13422E12E29C8231D88BC85C0573AD9077C56AA7F7A307E27F269DA17FBA8EE5A3
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):14336
                                                                                                                                                                                                  Entropy (8bit):5.137579183601755
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:5siHfq5po0ZUp8XnUp8XjEQnlDtW26rcqgcx2:nqDZUp8XUp8AclDN69gcx2
                                                                                                                                                                                                  MD5:F938A89AEC5F535AF25BD92221BBC141
                                                                                                                                                                                                  SHA1:384E1E92EBF1A6BBE068AB1493A26B50EFE43A7E
                                                                                                                                                                                                  SHA-256:774A39E65CC2D122F8D4EB314CED60848AFFF964FB5AD2627E32CB10EF28A6D0
                                                                                                                                                                                                  SHA-512:ED0506B9EBCEC26868F484464F9CC38E28F8056D6E55C536ECD2FD98F58F29F2D1CE96C5E574876A9AA6FD22D3756A49BC3EB464A7845CB3F28A1F3D1C98B4D7
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):13824
                                                                                                                                                                                                  Entropy (8bit):5.158343521612926
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:jsiHfq5pwUivkwXap8T0NchH73s47iDJxj2wcqgfvE:9qbi8wap8T0Ncp7n7iDbFgfvE
                                                                                                                                                                                                  MD5:173EED515A1ADDD1DA0179DD2621F137
                                                                                                                                                                                                  SHA1:D02F5E6EDA9FF08ABB4E88C8202BAD7DB926258F
                                                                                                                                                                                                  SHA-256:9D9574A71EB0DE0D14570B5EDA06C15C17CC2E989A20D1E8A4821CB813290D5F
                                                                                                                                                                                                  SHA-512:8926FBB78A00FD4DC67670670035D9E601AF27CDBE003DC45AD809E8DA1042DDECB997F44ED104BEC13391C8048051B0AAD0C10FDEEDFB7F858BA177E92FDC54
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text............................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):15360
                                                                                                                                                                                                  Entropy (8bit):5.469810464531962
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:RZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZNbRBP0rcqgjPrvE:sA0gHdzS1MwuiDSyoGmD/r89gjPrvE
                                                                                                                                                                                                  MD5:39B06A1707FF5FDC5B3170EB744D596D
                                                                                                                                                                                                  SHA1:37307B2826607EA8D5029293990EB1476AD6CC42
                                                                                                                                                                                                  SHA-256:2E8BB88D768890B6B68D5B6BB86820766ADA22B82F99F31C659F4C11DEF211A1
                                                                                                                                                                                                  SHA-512:98C3C45EB8089800EDF99ACEA0810820099BFD6D2C805B80E35D9239626CB67C7599F1D93D2A14D2F3847D435EAA065BF56DF726606BB5E8A96E527E1420633D
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...ry.e.........." ...#. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):13824
                                                                                                                                                                                                  Entropy (8bit):5.137646874307781
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:QF/1nb2eqCQtZl9k9VEmosHcBZTHGF31trDbu8oiZmtwcqgk+9TI:q2PXlG9VDos8BZA33rDbuNgk0gk+9U
                                                                                                                                                                                                  MD5:1DFC771325DD625DE5A72E0949D90E5F
                                                                                                                                                                                                  SHA1:8E1F39AAFD403EDA1E5CD39D5496B9FAA3387B52
                                                                                                                                                                                                  SHA-256:13F9ADBBD60D7D80ACEE80D8FFB461D7665C5744F8FF917D06893AA6A4E25E3A
                                                                                                                                                                                                  SHA-512:B678FB4AD6DF5F8465A80BFB9A2B0433CF6CFAD4C6A69EEBF951F3C4018FD09CB7F38B752BE5AB55C4BE6C88722F70521D22CBCBBB47F8C46DDB0B1ACBFD7D7E
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...}y.e.........." ...#..... ......P.....................................................`..........................................9.......:..d....`.......P...............p..,....4..............................P3..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):17920
                                                                                                                                                                                                  Entropy (8bit):5.687377356938656
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:bPHdP3MjeQTh+QAZUUw8lMF6D+1tgj+kf4:xPcKQT3iw8lfDUej+
                                                                                                                                                                                                  MD5:9D15862569E033C5AA702F9E4041C928
                                                                                                                                                                                                  SHA1:11376E8CB76AD2D9A7D48D11F4A74FB12B78BCF6
                                                                                                                                                                                                  SHA-256:8970DF77D2F73350360DBE68F937E0523689FF3D7C0BE95EB7CA5820701F1493
                                                                                                                                                                                                  SHA-512:322F0F4947C9D5D2800DEEBFD198EABE730D44209C1B61BB9FD0F7F9ED5F719AE49F8397F7920BDB368BB386A598E9B215502DC46FBE72F9340876CF40AFFC8A
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...sy.e.........." ...#.*..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):21504
                                                                                                                                                                                                  Entropy (8bit):5.9200472722347675
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:pljwGpJpvrp/LTaqvYHp5RYcARQOj4MSTjqgPmJDcOwwgjxo:Ljw4JbZYtswvqDc51j
                                                                                                                                                                                                  MD5:7398EFD589FBE4FEFADE15B52632CD5C
                                                                                                                                                                                                  SHA1:5EA575056718D3EC9F57D3CFF4DF87D77D410A4B
                                                                                                                                                                                                  SHA-256:F1970DB1DA66EFB4CD8E065C40C888EED795685FF4E5A6FA58CA56A840FE5B80
                                                                                                                                                                                                  SHA-512:C26F6FF693782C84460535EBCD35F23AA3C95FB8C0C8A608FB9A849B0EFD735EF45125397549C61248AE06BD068554D2DE05F9A3BA64F363438EDB92DA59481B
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...wy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):21504
                                                                                                                                                                                                  Entropy (8bit):5.922439979230845
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:jljwGpJpvrp/LtaqvYHp5RYcARQOj4MSTjqgPmJDcbegjxo:hjw4JVZYtswvqDcb7j
                                                                                                                                                                                                  MD5:352F56E35D58ABE96D6F5DBBD40D1FEA
                                                                                                                                                                                                  SHA1:5F0C9596B84B8A54D855441C6253303D0C81AA1B
                                                                                                                                                                                                  SHA-256:44EED167431151E53A8F119466036F1D60773DDEB8350AF972C82B3789D5D397
                                                                                                                                                                                                  SHA-512:CB4862B62ABB780656F1A06DADD3F80AEA453E226C38EFAE4318812928A7B0B6A3A8A86FCC43F65354B84FC07C7235FF384B75C2244553052E00DC85699D422A
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...uy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):26624
                                                                                                                                                                                                  Entropy (8bit):5.879121462749493
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:pDLZ9BjjBui0gel9soFdkO66MlPGXmXcnRDbRj:VBfu/FZ6nPxMRDtj
                                                                                                                                                                                                  MD5:3C47F387A68629C11C871514962342C1
                                                                                                                                                                                                  SHA1:EA3E508A8FB2D3816C80CD54CDD9C8254809DB00
                                                                                                                                                                                                  SHA-256:EA8A361B060EB648C987ECAF453AE25034DBEA3D760DC0805B705AC9AA1C7DD9
                                                                                                                                                                                                  SHA-512:5C824E4C0E2AB13923DC8330D920DCD890A9B33331D97996BC1C3B73973DF7324FFFB6E940FA5AA92D6B23A0E6971532F3DB4BF899A9DF33CC0DD6CB1AC959DD
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...zy.e.........." ...#.H..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...HG.......H.................. ..`.rdata..X....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):26624
                                                                                                                                                                                                  Entropy (8bit):5.937696428849242
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:VYL59Ugjaui0gel9soFdkO66MlPGXmXcXVDuSFAj:60xu/FZ6nPxMlD7Kj
                                                                                                                                                                                                  MD5:2F44F1B760EE24C89C13D9E8A06EA124
                                                                                                                                                                                                  SHA1:CF8E16D8324A7823B11474211BD7B95ADB321448
                                                                                                                                                                                                  SHA-256:7C7B6F59DD250BD0F8CBC5AF5BB2DB9F9E1A2A56BE6442464576CD578F0B2AE0
                                                                                                                                                                                                  SHA-512:2AACB2BB6A9EBA89549BF864DDA56A71F3B3FFEDB8F2B7EF3FC552AB3D42BC4B832F5FA0BA87C59F0F899EA9716872198680275A70F3C973D44CA7711DB44A14
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...|y.e.........." ...#.H..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):12800
                                                                                                                                                                                                  Entropy (8bit):5.027823764756571
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:/RF/1nb2eqCQtkbsAT2fixSrdYDt8ymjcqgQvEW:/d2P6bsK4H+DVwgQvEW
                                                                                                                                                                                                  MD5:64604EE3AEBEE62168F837A41BA61DB1
                                                                                                                                                                                                  SHA1:4D3FF7AC183BC28B89117240ED1F6D7A7D10AEF1
                                                                                                                                                                                                  SHA-256:20C3CC2F50B51397ACDCD461EE24F0326982F2DC0E0A1A71F0FBB2CF973BBEB2
                                                                                                                                                                                                  SHA-512:D03EEFF438AFB57E8B921CE080772DF485644DED1074F3D0AC12D3EBB1D6916BD6282E0E971408E89127FF1DAD1D0CB1D214D7B549D686193068DEA137A250CE
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):13312
                                                                                                                                                                                                  Entropy (8bit):5.020783935465456
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:+F/1nb2eqCQtks0iiNqdF4mtPjD0ZA5LPYcqgYvEL2x:02P6fFA/4GjDXcgYvEL2x
                                                                                                                                                                                                  MD5:E0EEDBAE588EE4EA1B3B3A59D2ED715A
                                                                                                                                                                                                  SHA1:4629B04E585899A7DCB4298138891A98C7F93D0B
                                                                                                                                                                                                  SHA-256:F507859F15A1E06A0F21E2A7B060D78491A9219A6A499472AA84176797F9DB02
                                                                                                                                                                                                  SHA-512:9FD82784C7E06F00257D387F96E732CE4A4BD065F9EC5B023265396D58051BECC2D129ABDE24D05276D5CD8447B7DED394A02C7B71035CED27CBF094ED82547D
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):15872
                                                                                                                                                                                                  Entropy (8bit):5.2616188776014665
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:JP2T9FRjRskTdf4YBU7YP5yUYDE1give:qHlRl57IC8UYDEG
                                                                                                                                                                                                  MD5:1708C4D1B28C303DA19480AF3C6D04FF
                                                                                                                                                                                                  SHA1:BAC78207EFAA6D838A8684117E76FB871BD423D5
                                                                                                                                                                                                  SHA-256:C90FB9F28AD4E7DEED774597B12AA7785F01DC4458076BE514930BF7AB0D15EC
                                                                                                                                                                                                  SHA-512:2A174C1CB712E8B394CBEE20C33974AA277E09631701C80864B8935680F8A4570FD040EA6F59AD71631D421183B329B85C749F0977AEB9DE339DFABE7C23762E
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...}y.e.........." ...#. ... ......P.....................................................`.........................................`9......T:..d....`.......P..p............p..,....3...............................2..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..p....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):15360
                                                                                                                                                                                                  Entropy (8bit):5.130670522779765
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:nZNGfqDgvUh43G6coX2SSwmPL4V7wTdDl41Y2cqgWjvE:CFMhuGGF2L4STdDcYWgWjvE
                                                                                                                                                                                                  MD5:E08355F3952A748BADCA2DC2E82AA926
                                                                                                                                                                                                  SHA1:F24828A3EEFB15A2550D872B5E485E2254C11B48
                                                                                                                                                                                                  SHA-256:47C664CB7F738B4791C7D4C21A463E09E9C1AAAE2348E63FB2D13FC3E6E573EB
                                                                                                                                                                                                  SHA-512:E7F48A140AFEF5D6F64A4A27D95E25A8D78963BB1F9175B0232D4198D811F6178648280635499C562F398613E0B46D237F7DB74A39B52003D6C8768B80EC6FB6
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):34816
                                                                                                                                                                                                  Entropy (8bit):5.935249615462395
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:gb+5F2hqrxS7yZAEfYcwcSPxpMgLp/GQNSpcVaGZ:gb+5Qwc7OAEfYcwJxpMgFJh
                                                                                                                                                                                                  MD5:DB56C985DBC562A60325D5D68D2E5C5B
                                                                                                                                                                                                  SHA1:854684CF126A10DE3B1C94FA6BCC018277275452
                                                                                                                                                                                                  SHA-256:089585F5322ADF572B938D34892C2B4C9F29B62F21A5CF90F481F1B6752BC59F
                                                                                                                                                                                                  SHA-512:274D9E4A200CAF6F60AC43F33AADF29C6853CC1A7E04DF7C8CA3E24A6243351E53F1E5D0207F23B34319DFC8EEE0D48B2821457B8F11B6D6A0DBA1AE820ACE43
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.\..........`.....................................................`..........................................~..d...$...d...............................,....s...............................q..@............p..(............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data................t..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):12288
                                                                                                                                                                                                  Entropy (8bit):4.799861986912974
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:YTIekCffqPSTMeAk4OeR64ADpki6RcqgO5vE:YTNZMcPeR64ADh63gO5vE
                                                                                                                                                                                                  MD5:6229A84562A9B1FBB0C3CF891813AADD
                                                                                                                                                                                                  SHA1:4FAFB8AF76A7F858418AA18B812FEACADFA87B45
                                                                                                                                                                                                  SHA-256:149027958A821CBC2F0EC8A0384D56908761CC544914CED491989B2AD9D5A4DC
                                                                                                                                                                                                  SHA-512:599C33F81B77D094E97944BB0A93DA68D2CCB31E6871CE5679179FB6B9B2CE36A9F838617AC7308F131F8424559C5D1A44631E75D0847F3CC63AB7BB57FE1871
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):754176
                                                                                                                                                                                                  Entropy (8bit):7.628627007698131
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:12288:31ETHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h+b:lETHoxJFf1p34hcrn5Go9yQO6g
                                                                                                                                                                                                  MD5:BBB83671232E0BE361E812369A463E03
                                                                                                                                                                                                  SHA1:A37DAEC475AB230E14897077D17E20B7A5112B8D
                                                                                                                                                                                                  SHA-256:873A3E3E945421917BA780D95C78ECCB92D4E143227987D6812BC9F9E4653BE0
                                                                                                                                                                                                  SHA-512:BF6718DE5235F6A7C348A1E2F325FEE59C74356D4722DFA99DA36A2BE1E6386C544EEC09190E2EBBA58B7C6B4157D00409C59F29AE2CC7BC13CBC301B8592586
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.....L...L...L.V+L...LKR.M...L.V.M...L...L...LKR.M...LKR.M...LKR.M...L-S.M...L-S.M...L-SGL...L-S.M...LRich...L................PE..d....y.e.........." ...#.n..........`.....................................................`..........................................p..d...dq..d...............$...............4...@Z...............................Y..@...............(............................text....m.......n.................. ..`.rdata...............r..............@..@.data...x............h..............@....pdata..$............p..............@..@.rsrc................~..............@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):27648
                                                                                                                                                                                                  Entropy (8bit):5.799740467345125
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:PvRwir5rOF2MZz1n0/kyTMIl9bhgIW0mvBaeoSzra2pftjGQDdsC0MgkbQ0e1r:PJLtg2MTeM+9dmvBaeoCtaQDekf
                                                                                                                                                                                                  MD5:7F2C691DEB4FF86F2F3B19F26C55115C
                                                                                                                                                                                                  SHA1:63A9D6FA3B149825EA691F5E9FDF81EEC98224AA
                                                                                                                                                                                                  SHA-256:BF9224037CAE862FE220094B6D690BC1992C19A79F7267172C90CBED0198582E
                                                                                                                                                                                                  SHA-512:3A51F43BF628E44736859781F7CFF0E0A6081CE7E5BDE2F82B3CDB52D75D0E3DFAE92FC2D5F7D003D0B313F6835DBA2E393A0A8436F9409D92E20B65D3AED7E2
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y...............i...................i......i......i......................m...........Rich...........PE..d....y.e.........." ...#.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text....D.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):67072
                                                                                                                                                                                                  Entropy (8bit):6.060804942512998
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:HqvnErJyGoqQXZKfp23mXKUULBeCFTUCqHF+PELb7MSAEfnctefBd5:HqvnErJyGoqQXZKfp2ayLsCFTUCqHEP4
                                                                                                                                                                                                  MD5:AF46798028AB3ED0E56889DFB593999B
                                                                                                                                                                                                  SHA1:D4D7B39A473E69774771B2292FDBF43097CE6015
                                                                                                                                                                                                  SHA-256:FD4F1F6306950276A362D2B3D46EDBB38FEABA017EDCA3CD3A2304340EC8DD6C
                                                                                                                                                                                                  SHA-512:58A80AFEEAC16D7C35F8063D03A1F71CA6D74F200742CAE4ADB3094CF4B3F2CD1A6B3F30A664BD75AB0AF85802D935B90DD9A1C29BFEA1B837C8C800261C6265
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.....8......`........................................@............`.............................................h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..j...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):10752
                                                                                                                                                                                                  Entropy (8bit):4.488129745837651
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:96:kfuF7pVVdJvbrqTuy/Th/Y0IluLfcC75JiC4cs89EfqADQhDsAbcX6gn/7EC:TF/VddiTHThQTctdErDQDsicqgn/7
                                                                                                                                                                                                  MD5:F4B7324A8F7908C3655BE4C75EAC36E7
                                                                                                                                                                                                  SHA1:11A30562A85A444F580213417483BE8D4D9264AD
                                                                                                                                                                                                  SHA-256:5397E3F5762D15DCD84271F49FC52983ED8F2717B258C7EF370B24977A5D374B
                                                                                                                                                                                                  SHA-512:66CA15A9BAD39DD4BE7921A28112A034FFE9CD11F91093318845C269E263804AB22A4AF262182D1C6DAC8741D517362C1D595D9F79C2F729216738C3DD79D7C2
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4=.bUS.bUS.bUS.k-..`US..)R.`US.)-R.aUS.bUR.FUS..)V.iUS..)W.jUS..)P.aUS.([.cUS.(S.cUS.(..cUS.(Q.cUS.RichbUS.................PE..d....y.e.........." ...#............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):10240
                                                                                                                                                                                                  Entropy (8bit):4.733990521299615
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:192:PzVVddiTHThQTctEEaEDKDnMRWJcqgbW6:PzTMdsc+EaEDKDnCWvgbW
                                                                                                                                                                                                  MD5:3D566506052018F0556ADF9D499D4336
                                                                                                                                                                                                  SHA1:C3112FF145FACF47AF56B6C8DCA67DAE36E614A2
                                                                                                                                                                                                  SHA-256:B5899A53BC9D3112B3423C362A7F6278736418A297BF86D32FF3BE6A58D2DEEC
                                                                                                                                                                                                  SHA-512:0AC6A1FC0379F5C3C80D5C88C34957DFDB656E4BF1F10A9FA715AAD33873994835D1DE131FC55CD8B0DEBDA2997993E978700890308341873B8684C4CD59A411
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):10240
                                                                                                                                                                                                  Entropy (8bit):4.689063511060661
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:96:P/ryZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DIWMot4BcX6gbW6O:PzQVddiTHThQTctEEO3DSoKcqgbW6
                                                                                                                                                                                                  MD5:FAE081B2C91072288C1C8BF66AD1ABA5
                                                                                                                                                                                                  SHA1:CD23DDB83057D5B056CA2B3AB49C8A51538247DE
                                                                                                                                                                                                  SHA-256:AF76A5B10678F477069ADD6E0428E48461FB634D9F35FB518F9F6A10415E12D6
                                                                                                                                                                                                  SHA-512:0ADB0B1088CB6C8F089CB9BF7AEC9EEEB1717CF6CF44B61FB0B053761FA70201AB3F7A6461AAAE1BC438D689E4F8B33375D31B78F1972AA5A4BF86AFAD66D3A4
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\VCRUNTIME140.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):109440
                                                                                                                                                                                                  Entropy (8bit):6.642252418996898
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
                                                                                                                                                                                                  MD5:49C96CECDA5C6C660A107D378FDFC3D4
                                                                                                                                                                                                  SHA1:00149B7A66723E3F0310F139489FE172F818CA8E
                                                                                                                                                                                                  SHA-256:69320F278D90EFAAEB67E2A1B55E5B0543883125834C812C8D9C39676E0494FC
                                                                                                                                                                                                  SHA-512:E09E072F3095379B0C921D41D6E64F4F1CD78400594A2317CFB5E5DCA03DEDB5A8239ED89905C9E967D1ACB376B0585A35ADDF6648422C7DDB472CE38B1BA60D
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{n...=...=...=l..<...=...=...=...=...=...<...=...<...=...<...=...<...=...=...=...<...=Rich...=........PE..d.....K..........." ...$.....`............................................................`A........................................`C..4....K...............p..|....\...O...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata..|....p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\VCRUNTIME140_1.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):49560
                                                                                                                                                                                                  Entropy (8bit):6.6649899041961875
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
                                                                                                                                                                                                  MD5:CF0A1C4776FFE23ADA5E570FC36E39FE
                                                                                                                                                                                                  SHA1:2050FADECC11550AD9BDE0B542BCF87E19D37F1A
                                                                                                                                                                                                  SHA-256:6FD366A691ED68430BCD0A3DE3D8D19A0CB2102952BFC140BBEF4354ED082C47
                                                                                                                                                                                                  SHA-512:D95CD98D22CA048D0FC5BCA551C9DB13D6FA705F6AF120BBBB621CF2B30284BFDC7320D0A819BB26DAB1E0A46253CC311A370BED4EF72ECB60C69791ED720168
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V...V...V......T.......T..._.D.]...V...e.......S.......Q.......M.......W.....(.W.......W...RichV...........PE..d...}.4..........." ...$.<...8.......A..............................................e4....`A........................................0m.......m..x....................r...O......D....c..p...........................pb..@............P..h............................text...@:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_bz2.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):84760
                                                                                                                                                                                                  Entropy (8bit):6.571366239395909
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:+O1z7poK78xa5yp6aclDqGihM8Vh948L5IsCVQ7SyhxG:31z9h9plDshvVhH5IsCVQk
                                                                                                                                                                                                  MD5:4438AFFAAA0CA1DF5B9B1CDAA0115EC1
                                                                                                                                                                                                  SHA1:4EDA79EAF3DE614D5F744AA9EEA5BFCF66E2D386
                                                                                                                                                                                                  SHA-256:EC91E2B4BACA31B992D016B84B70F110CE2B1B2DFD54F5E5BEF6270ED7D13B85
                                                                                                                                                                                                  SHA-512:6992107AC4D2108E477BC81AF667B8B8E5439231E7E9F4B15CE4BCE1AEEA811BC0F1AAA438BE3B0E38597760CB504367512809EE1937C4B538A86724AE543BA6
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,...B...B...B......B.i.C...B.i.....B.i.G...B.i.F...B.i.A...B..C...B..C...B...C..B..O...B..B...B......B..@...B.Rich..B.........................PE..d....k.d.........." ...$.....^...............................................P......2.....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_ctypes.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):123672
                                                                                                                                                                                                  Entropy (8bit):6.0603476725812415
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:3072:T7u5LnIxdP3fPHW+gfLIhAxKpemWtIsLPKlY:Tw+3FgfLIhFemWeY
                                                                                                                                                                                                  MD5:6114277C6FC040F68D25CA90E25924CD
                                                                                                                                                                                                  SHA1:028179C77CB3BA29CD8494049421EAA4900CCD0E
                                                                                                                                                                                                  SHA-256:F07FE92CE85F7786F96A4D59C6EE5C05FE1DB63A1889BA40A67E37069639B656
                                                                                                                                                                                                  SHA-512:76E8EBEFB9BA4EA8DCAB8FCE50629946AF4F2B3F2F43163F75483CFB0A97968478C8AAEF1D6A37BE85BFC4C91A859DEDA6DA21D3E753DAEFE084A203D839353D
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D...D...D...M.".B......F......H......L......@...^..F......E......B......G...D.......^..B...^..E...^.N.E...^..E...RichD...........PE..d....k.d.........." ...$............p\..............................................[.....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_decimal.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):253720
                                                                                                                                                                                                  Entropy (8bit):6.554150968006557
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:6144:3V9E1CyOa72oP+pG1/dgD09qWM53pLW1ADDtLRO75e:jEgyOa72jw1/d4VVhLE5e
                                                                                                                                                                                                  MD5:BE315973AFF9BDEB06629CD90E1A901F
                                                                                                                                                                                                  SHA1:151F98D278E1F1308F2BE1788C9F3B950AB88242
                                                                                                                                                                                                  SHA-256:0F9C6CC463611A9B2C692382FE1CDD7A52FEA4733FFAF645D433F716F8BBD725
                                                                                                                                                                                                  SHA-512:8EA715438472E9C174DEE5ECE3C7D9752C31159E2D5796E5229B1DF19F87316579352FC3649373DB066DC537ADF4869198B70B7D4D1D39AC647DA2DD7CFC21E8
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.`...`...`.......`..,....`..,....`..,....`..,....`.......`.......`...`...`.......`.......`.......`....r..`.......`..Rich.`..........................PE..d....k.d.........." ...$.x...<......|...............................................>.....`.........................................0T..P....T...................'......./......P.......T...........................p...@............................................text...-w.......x.................. ..`.rdata..|............|..............@..@.data....*...p...$...T..............@....pdata...'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_hashlib.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):65304
                                                                                                                                                                                                  Entropy (8bit):6.256836184121913
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:nfKlLLgy209/MkZy6nR3JZlivy7OjZopRIsOI/7SyAxn4:fKBgy+IZlh7OjSpRIsOI/M4
                                                                                                                                                                                                  MD5:1524882AF71247ADECF5815A4E55366A
                                                                                                                                                                                                  SHA1:E25014C793C53503BDFF9AF046140EDDA329D01B
                                                                                                                                                                                                  SHA-256:6F7742DFDD371C39048D775F37DF3BC2D8D4316C9008E62347B337D64EBED327
                                                                                                                                                                                                  SHA-512:5B954BB7953F19AA6F7C65AD3F105B77D37077950FB1B50D9D8D337BDD4B95343BAC2F4C9FE17A02D1738D1F87EEEF73DBBF5CDDDCB470588CBC5A63845B188A
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,'@.MI..MI..MI..5...MI.:3H..MI.:3L..MI.:3M..MI.:3J..MI..2H..MI..5H..MI.G0H..MI..MH..MI..2D..MI..2I..MI..2...MI..2K..MI.Rich.MI.........PE..d....l.d.........." ...$.T...~......@@...............................................7....`............................................P... ............................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata...O...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_lzma.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):159000
                                                                                                                                                                                                  Entropy (8bit):6.8491410545695715
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:3072:2tZVL5rdV/REWWjAYyznf49mNo+RRApqc5IsZ1v8N:2tZV3pREMAYO+ElG
                                                                                                                                                                                                  MD5:737119A80303EF4ECCAA998D500E7640
                                                                                                                                                                                                  SHA1:328C67C6C4D297AC13DA725BF24467D8B5E982E3
                                                                                                                                                                                                  SHA-256:7158C1290AC29169160B3EC94D9C8BCDE4012D67A555F325D44B418C54E2CC28
                                                                                                                                                                                                  SHA-512:1C9920E0841A65B01A0B339C5F5254D1039EF9A16FE0C2484A7E2A9048727F2CC081817AA771B0C574FB8D1A5A49DC39798A3C5E5B5E64392E9C168E1827BE7C
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..'..lt..lt..lt...t..lt..mu..lt..iu..lt..hu..lt..ou..lt..mu..ltM.mu..lt..mt`.lt..au<.lt..lu..lt..t..lt..nu..ltRich..lt................PE..d....l.d.........." ...$.b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text...za.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_queue.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):32536
                                                                                                                                                                                                  Entropy (8bit):6.452372346765785
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:K+yFV6rXMmxU9tIsQUl5YiSyvYAMxkEl1C:K+wEXMWU9tIsQUr7SyexXC
                                                                                                                                                                                                  MD5:8BBED19359892F8C95C802C6AD7598E9
                                                                                                                                                                                                  SHA1:773FCA164965241F63170E7A1F3A8FA17F73EA18
                                                                                                                                                                                                  SHA-256:4E5B7C653C1B3DC3FD7519E4F39CC8A2FB2746E0ECDC4E433FE6029F5F4D9065
                                                                                                                                                                                                  SHA-512:22EA7667689A9F049FA34DDAE6B858E1AF3E646A379D2C5A4AEF3E74A4FF1A4109418B363C9BE960127F1C7E020AA393A47885BC45517C9E9AEBE71EC7CB61A0
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7X.Y..Y..Y......Y.v.X..Y.v.\..Y.v.]..Y.v.Z..Y...X..Y...X..Y..X...Y...T..Y...Y..Y.....Y...[..Y.Rich.Y.........................PE..d....k.d.........." ...$.....8............................................................`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_socket.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):79640
                                                                                                                                                                                                  Entropy (8bit):6.290503224602847
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:zbflGOzI+Jmrc0r3uj+9/s+S+pzpDAiTFVf78tIsLwy7SyJx+:V/IMA3uj+9/sT+pztAYFVT8tIsLwyA
                                                                                                                                                                                                  MD5:64A6C475F59E5C57B3F4DD935F429F09
                                                                                                                                                                                                  SHA1:CA2E0719DC32F22163AE0E7B53B2CAADB0B9D023
                                                                                                                                                                                                  SHA-256:D03FA645CDE89B4B01F4A2577139FBB7E1392CB91DC26213B3B76419110D8E49
                                                                                                                                                                                                  SHA-512:CF9E03B7B34CC095FE05C465F9D794319AAA0428FE30AB4DDCE14BA78E835EDF228D11EC016FD31DFE9F09D84B6F73482FB8E0F574D1FD08943C1EC9E0584973
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........e...e...e.......e..N....e..N....e..N....e..N....e.......e...e..Re.......e.......e.......e....{..e.......e..Rich.e..................PE..d....l.d.........." ...$.l...........%.......................................P......e]....`.............................................P............0....... ..x......../...@..........T...............................@............................................text...6k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_ssl.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):176920
                                                                                                                                                                                                  Entropy (8bit):5.954664688637172
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:3072:LFIQQShnmJg0ADm8H4qIOuXo6XHFBN9d41Olh59YL48PMrN/WgAlNzn5IsC7/1a:GShmaJDm24q6o6XHR4BLrT
                                                                                                                                                                                                  MD5:A0B40F1F8FC6656C5637EACACF7021F6
                                                                                                                                                                                                  SHA1:38813E25FFDE1EEE0B8154FA34AF635186A243C1
                                                                                                                                                                                                  SHA-256:79D861F0670828DEE06C2E3523E2F9A2A90D6C6996BDE38201425AA4003119F1
                                                                                                                                                                                                  SHA-512:C18855D7C0069FFF392D422E5B01FC518BBDF497EB3390C0B333ECAC2497CD29ABBDAE4557E4F0C4E90321FBA910FC3E4D235CE62B745FA34918F40FA667B713
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@.L.@.L.@.L.8$L.@.L.>.M.@.L.>.M.@.L.>.M.@.L.>.M.@.L.?.M.@.Lw=.M.@.L.@.L A.L.8.M.@.L.?.M.@.L.?.M.@.L.?HL.@.L.?.M.@.LRich.@.L........PE..d....l.d.........." ...$............l+....................................................`.........................................0...d................................/......|...P...T...............................@............................................text............................... ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\_uuid.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):25368
                                                                                                                                                                                                  Entropy (8bit):6.630514624008701
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:BfodpEWFfivQ5IsZwryHQIYiSy1pCQsmFlXAM+o/8E9VF0NywmV:BKpEC4Q5IsZwE5YiSyvhAMxkEdV
                                                                                                                                                                                                  MD5:4FAA479423C54D5BE2A103B46ECB4D04
                                                                                                                                                                                                  SHA1:011F6CDBD3BADAA5C969595985A9AD18547DD7EC
                                                                                                                                                                                                  SHA-256:C2AD3C1B4333BC388B6A22049C89008505C434B1B85BFF0823B19EF0CF48065A
                                                                                                                                                                                                  SHA-512:92D35824C30667AF606BBA883BF6E275F2A8B5CBFEA2E84A77E256D122B91B3EE7E84D9F4E2A4946E903A11293AF9648A45E8CFBE247CBDC3BCDEA92EB5349C6
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p..r#..r#..r#...#..r#:.s"..r#:.w"..r#:.v"..r#:.q"..r#..s"..r#.s"..r#..s#..r#..z"..r#..r"..r#...#..r#..p"..r#Rich..r#........PE..d....k.d.........." ...$.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\base_library.zip

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):1438582
                                                                                                                                                                                                  Entropy (8bit):5.590818209842686
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:24576:mQR5pATuz/R5lUKdcubgAnyfbPer0iwhxdYf9Pqe9HH4:mQR5p1/RpL0
                                                                                                                                                                                                  MD5:5B5EDC46B4A4F69E88049D94A5FB26A1
                                                                                                                                                                                                  SHA1:C4B4813EDAFE8EEE13A12817103FC5550075E0EC
                                                                                                                                                                                                  SHA-256:114F8953BFB6F74630C6E17806F978A5B0EE8E1B26EFA5797C3FDE56EE9336D0
                                                                                                                                                                                                  SHA-512:3C444F59B196A95B034D6452A1F4541E969868B75780B777833704190E9C4653B90B2B80AE89AED74FB17FD8F3504901F09E00D1D0B8163299C4F0E28A8A4556
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\certifi\cacert.pem

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):290282
                                                                                                                                                                                                  Entropy (8bit):6.048183244201235
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
                                                                                                                                                                                                  MD5:302B49C5F476C0AE35571430BB2E4AA0
                                                                                                                                                                                                  SHA1:35A7837A3F1B960807BF46B1C95EC22792262846
                                                                                                                                                                                                  SHA-256:CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
                                                                                                                                                                                                  SHA-512:1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):10752
                                                                                                                                                                                                  Entropy (8bit):4.673454313041419
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:96:KG+p72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFliHUWQcX6g8cim1qeSju1:A2HzzU2bRYoeLHkcqgvimoe
                                                                                                                                                                                                  MD5:723EC2E1404AE1047C3EF860B9840C29
                                                                                                                                                                                                  SHA1:8FC869B92863FB6D2758019DD01EDBEF2A9A100A
                                                                                                                                                                                                  SHA-256:790A11AA270523C2EFA6021CE4F994C3C5A67E8EAAAF02074D5308420B68BD94
                                                                                                                                                                                                  SHA-512:2E323AE5B816ADDE7AAA14398F1FDB3EFE15A19DF3735A604A7DB6CADC22B753046EAB242E0F1FBCD3310A8FBB59FF49865827D242BAF21F44FD994C3AC9A878
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d...siAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):119296
                                                                                                                                                                                                  Entropy (8bit):5.872097486056729
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:OzgMw0g+m/+rxC9Jtd960WsCyqPD1/bZMlDML48Be9zGTVmZRJIRbvB:OsTH+VC9Jtd9VdCr7fMp/8yGTVmzmZ
                                                                                                                                                                                                  MD5:9EA8098D31ADB0F9D928759BDCA39819
                                                                                                                                                                                                  SHA1:E309C85C1C8E6CE049EEA1F39BEE654B9F98D7C5
                                                                                                                                                                                                  SHA-256:3D9893AA79EFD13D81FCD614E9EF5FB6AAD90569BEEDED5112DE5ED5AC3CF753
                                                                                                                                                                                                  SHA-512:86AF770F61C94DFBF074BCC4B11932BBA2511CAA83C223780112BDA4FFB7986270DC2649D4D3EA78614DBCE6F7468C8983A34966FC3F2DE53055AC6B5059A707
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d...siAe.........." ...%.*..........0........................................ ............`.........................................p...d..........................................Px...............................w..@............@...............................text...X).......*.................. ..`.rdata...X...@...Z..................@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\libcrypto-3.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):5157656
                                                                                                                                                                                                  Entropy (8bit):5.95816549046812
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:98304:OH+jTaoFABs2NPAE7uLcdKmj8waP31CPwDvt3uFlDC:kQ+Bs2NQcdKmj8waP1CPwDvt3uFlDC
                                                                                                                                                                                                  MD5:7A6A8C2A8C379B111CDCEB66B18D687D
                                                                                                                                                                                                  SHA1:F3B8A4C731FA0145F224112F91F046FDDF642794
                                                                                                                                                                                                  SHA-256:8E13B53EE25825B97F191D77B51ED03966F8B435773FA3FBC36F3EB668FC569B
                                                                                                                                                                                                  SHA-512:F2EF1702DF861EF55EF397AD69985D62B675D348CAB3862F6CA761F1CE3EE896F663A77D7B69B286BE64E7C69BE1215B03945781450B186FC02CFB1E4CB226B5
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d......d.........." ...#..6..&......v.........................................O......eO...`..........................................zG.0.....M.@.... N.s.....K......N../...0N......bC.8...........................0aC.@.............M..............................text...t.6.......6................. ..`.rdata........6.......6.............@..@.data....n....J..<...vJ.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.....N.......M.............@..@.rsrc...s.... N.......M.............@..@.reloc..S....0N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\libffi-8.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):39696
                                                                                                                                                                                                  Entropy (8bit):6.641880464695502
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                  MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                  SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                  SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                  SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\libssl-3.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):789784
                                                                                                                                                                                                  Entropy (8bit):5.607345956416271
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:6144:9jurAr6yUDGpdXh3Mr3r0oARnjmeUl4XOnZiRtw036WgfCBL5JyJ/OiFe9XbI:9MT6h3M7VxKXOrqdeOiFe9Xb
                                                                                                                                                                                                  MD5:64ACB046FE68D64EE475E19F67253A3C
                                                                                                                                                                                                  SHA1:D9E66C9437CE6F775189D6FDBD171635193EC4CC
                                                                                                                                                                                                  SHA-256:B21309ABD3DBBB1BF8FB6AA3C250FC85D7B0D9984BF4C942D1D4421502F31A10
                                                                                                                                                                                                  SHA-512:F8B583981DF528CF4F1854B94EFF6F51DD9D4BE91E6FA6329A8C4435B705457C868AE40EE030FA54BEBB646A37B547BC182C9CBF0DF9A07FEA03A18CF85C6766
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...T...T...].3.Z......V......V......X......\......P.....W...T...H.....e.....U...._.U.....U...RichT...................PE..d....d.........." ...#.4..........K........................................0...........`..........................................x...Q..............i.... ..|M......./......`.......8...............................@............................................text...D3.......4.................. ..`.rdata...y...P...z...8..............@..@.data....N.......H..................@....pdata..dV... ...X..................@..@.idata...c.......d...R..............@..@.00cfg..u...........................@..@.rsrc...i...........................@..@.reloc..?...........................@..B........................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\pfp.png

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):102219
                                                                                                                                                                                                  Entropy (8bit):7.954868090714067
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:3072:PjEoy+bEVdPST62bL1YXHNCE830dbO8TlUo8tZ4:7/pvXbL1YXtCnloY6
                                                                                                                                                                                                  MD5:36C7DC444B4D69C4EF6F60BC295E0846
                                                                                                                                                                                                  SHA1:BFC43CA5533746EC2F74086852358B2FF7EE874C
                                                                                                                                                                                                  SHA-256:63D2D74911A9BCF31D896F54DC4D2879326E6AC6FF1B7F431FAF27A051403BFD
                                                                                                                                                                                                  SHA-512:B00B39FA9496A6489B14BC8FA5BBE6A92D29B86A85801AC46362F7BAC1F70FF649B046A654842880D51D3D0B43D18A5FCFE0E22F6B36B7435E94A182F6B91A9F
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:.PNG........IHDR.............\r.f..>MzTXtRaw profile type exif..x..Y.%..e.m....h.r0.H.....*.(%.n&3"......{u@\...........ZkW.O.....{........p........._...c.......V.|........*..Bm.....o...=.....%.(...B..R.}#......]{{..+...}......./.....~..........I1....).y...J.?..W.....9..%.?O...u....'z}../...j.........I.........P...|K._...f.._.Y.....V...w..{g.b..R.?/..|...&.........o....O.U/La....B...zC.;.........s<W|.C.+..-=............vjl...=.......^.w..w.Gc.b.....\....WW..n........c.s.........[.........,....Y....,.?. }......?....s...[...o.].....'.'....A.G.@.d.B)q.1.T...5.y....D.|.u...(.....4.........J....Vz.5.\K.....x...<.y...g..r+.....m....Yz.Oo..1....O.~`..g.y.k...6....Yy.U...k...?v..n..q...N>...v../.....oy.......{..l.......g..S...........A8).........-...{v..st...G..D...g;.c.`>!.7..wW..;...o..a.....]n..s.}...m...v.....=.3.9...O...gn.~...R.{.....q.Ng.g..w.=N.........vV+p..l...*|:....w`M..x.L.`i.c..F.c.Vc..........a.@D.....Wfcs.yq.:.{*O.'.

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\psutil\_psutil_windows.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):67072
                                                                                                                                                                                                  Entropy (8bit):5.906140071654569
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:PwseNxkc7Xva0Y420G1UD+dS4LBeLmRy:Pskcbi0Y42bUD+dS4VeiRy
                                                                                                                                                                                                  MD5:2C62184E46ECC1641B8E09690F820405
                                                                                                                                                                                                  SHA1:953DB2789D5EEAB981558388A727BD4D42364DD6
                                                                                                                                                                                                  SHA-256:43E09408673687A787415912336AC13FCCA9A7D7945B73D0C84AC4BB071E9106
                                                                                                                                                                                                  SHA-512:2DF440A9BF87345A5A0727CF4AE68592B32324A3A4D4611D047FBCA7984A9B8E55487D89E83E80DF8E0580C2A1DB26DB9722DBF18D4B2C8FD2770A55309E573E
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZT...5...5...5...M...5..L@...5..L@...5..L@...5..L@...5...k...5..UM...5...5...5...@...5...@...5...@`..5...@...5..Rich.5..........................PE..d....v*e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\python3.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):67352
                                                                                                                                                                                                  Entropy (8bit):6.145559867069682
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:768:ow/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS7:P/5k8cnzeJptIsL0t7Sym1xm
                                                                                                                                                                                                  MD5:0E105F62FDD1FF4157560FE38512220B
                                                                                                                                                                                                  SHA1:99BD69A94B3DC99FE2C0F7BBBCD05AA0BC8CD45C
                                                                                                                                                                                                  SHA-256:803BA8242B409080DF166320C05A4402AAB6DD30E31C4389871F4B68CA1AD423
                                                                                                                                                                                                  SHA-512:59C0F749ED9C59EFDBCD04265B4985B1175FDD825E5A307745531ED2537397E739BC9290FDC3936CFD04F566E28BB76B878F124248B8344CF74F641C6B1101DE
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...,e..,e..,e..Sm..,e..Se..,e..S...,e..Sg..,e.Rich.,e.........PE..d....k.d.........." ...$............................................................4.....`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\python311.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):5765912
                                                                                                                                                                                                  Entropy (8bit):6.089565479797802
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:98304:BBduVia4N3NWLvJP8IjF/d/aHMMwuPQyFF+RdioiZPbwappjDq:BBduVv4N3ILvJ8M/4wZy3+RdioiZPbwl
                                                                                                                                                                                                  MD5:58E01ABC9C9B5C885635180ED104FE95
                                                                                                                                                                                                  SHA1:1C2F7216B125539D63BD111A7ABA615C69DEB8BA
                                                                                                                                                                                                  SHA-256:DE1B95D2E951FC048C84684BC7DF4346138910544EE335B61FC8E65F360C3837
                                                                                                                                                                                                  SHA-512:CD32C77191309D99AEED47699501B357B35669123F0DD70ED97C3791A009D1855AB27162DB24A4BD9E719B68EE3B0539EE6DB88E71ABB9A2D4D629F87BC2C081
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ed..Ed..Ed......Gd......Kd......Id......Md......Ad..L.{._d......Nd..Ed.. e.._...d.._...Dd.._...Dd.._...Dd..RichEd..................PE..d....k.d.........." ...$.`%..87......K........................................\.....nMX...`...........................................@......ZA......p[.......V..0....W../....[..B....).T...........................`.).@............p%..............................text...._%......`%................. ..`.rdata.......p%......d%.............@..@.data.........A..L...tA.............@....pdata...0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......~V.............@..@.reloc...B....[..D....V.............@..B................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):134656
                                                                                                                                                                                                  Entropy (8bit):5.995319660651805
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:3072:luJ2G0a2fYrFceQaVK756Y/r06trRjEKQze7KN9eJKVKG6j1J:luJ2faiYrFceQaVfY/rx1eze7KbewVrk
                                                                                                                                                                                                  MD5:90B786DC6795D8AD0870E290349B5B52
                                                                                                                                                                                                  SHA1:592C54E67CF5D2D884339E7A8D7A21E003E6482F
                                                                                                                                                                                                  SHA-256:89F2A5C6BE1E70B3D895318FDD618506B8C0E9A63B6A1A4055DFF4ABDC89F18A
                                                                                                                                                                                                  SHA-512:C6E1DBF25D260C723A26C88EC027D40D47F5E28FC9EB2DBC72A88813A1D05C7F75616B31836B68B87DF45C65EEF6F3EAED2A9F9767F9E2F12C45F672C2116E72
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\select.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):30488
                                                                                                                                                                                                  Entropy (8bit):6.586478365575897
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:384:dEeecReJKuHq1W57AvB0EZtIsQGQHQIYiSy1pCQvC5HAM+o/8E9VF0Ny5X3:XeUeJPHqoGDtIsQGq5YiSyvmAMxkE/3
                                                                                                                                                                                                  MD5:653BDCCB7AF2AA9CCF50CB050FD3BE64
                                                                                                                                                                                                  SHA1:AFE0A85425AE911694C250AB4CB1F6C3D3F2CC69
                                                                                                                                                                                                  SHA-256:E24A3E7885DF9A18C29BA058C49C3ADCF59E4B58107847B98ECA365B6D94F279
                                                                                                                                                                                                  SHA-512:07E841FDA7A2295380BFA05DB7A4699F18C6E639DA91D8EE2D126D4F96E4CDDAEDBD490DEB4D2A2E8E5877EDFFF877693F67A9DC487E29742943E062D7BE6277
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t..'..'..'...'..'...&..'...&..'...&..'...&..'...&..'..'..'...&..'...&..'...&..'..c'..'...&..'Rich..'........................PE..d....k.d.........." ...$.....2......................................................;.....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\tls_client\dependencies\tls-client-64.dll

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):16469637
                                                                                                                                                                                                  Entropy (8bit):5.676212738080748
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:98304:JX7MOhpPFReSfiYzyFIE6Z+7Sx0CxJE8KTpVYFSL:JL31ih6Z+OBxepVt
                                                                                                                                                                                                  MD5:6B0B5BB89D4FAB802687372D828321B4
                                                                                                                                                                                                  SHA1:A6681BEE8702F7ABBCA891AC64F8C4FB7B35FBB5
                                                                                                                                                                                                  SHA-256:EC4F40C5F1AC709313B027C16FACE4D83E0DAFDBC466CFF2FF5D029D00600A20
                                                                                                                                                                                                  SHA-512:50C857F4A141AD7DB8B6D519277033976BF97C9A7B490186A283403C05CB83B559A596EFAF87CA46BC66BDF6B80636F4622324551C9DE2C26BEBFDBB02209D34
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d............2....& ...%..4..vl..(..P.........L+.........................................`... .......................................q.......r.\.............k.(............0r.x...........................@.k.(.....................r.h............................text...@.4.......4.................`..`.data.........4.......4.............@....rdata........<.......<.............@..@.pdata..(.....k......pk.............@..@.xdata........k......vk.............@..@.bss.....'....k..........................edata........q......|k.............@..@.idata..\.....r......~k.............@....CRT....X.....r.......k.............@....tls......... r.......k.............@....reloc..x....0r.......k.............@..B/4........... s......|l.............@..B/19.....K|&..0s..~&...l.............@..B/31......8.......:..................@..B/45.....y...........<..............@..B/57.....

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\unicodedata.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):1141016
                                                                                                                                                                                                  Entropy (8bit):5.435066249596469
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:12288:P3EYbfjwR6nbsonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1JD:PUYbMB0IDJcjEwPgPOG6Xyd461JD
                                                                                                                                                                                                  MD5:1905B5D0F945499441E8CD58EB123D86
                                                                                                                                                                                                  SHA1:117E584E6FCC0E8CFC8E24E3AF527999F14BAC30
                                                                                                                                                                                                  SHA-256:B1788B81FA160E5120451F9252C7745CDDE98B8CE59BF273A3DD867BB034C532
                                                                                                                                                                                                  SHA-512:ED88CD7E3259239A0C8D42D95FA2447FC454A944C849FA97449AD88871236FEFDAFE21DBFA6E9B5D8A54DDF1D5281EC34D314CB93D47CE7B13912A69D284F522
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D|............eG.....c.....c.....c.....c.....b....Ke.......Q...b.....b.....b+.....b....Rich...........................PE..d....k.d.........." ...$.@..........P*..............................................J.....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI73602\win32\win32crypt.pyd

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):123904
                                                                                                                                                                                                  Entropy (8bit):5.966536263597539
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:1536:qcoj2WDPYNSPEkIrFCkAShRD/bv0SShzljLraBqf9308qxJ83zEBoPTEdLQEF8/d:q7jbPA0SD9S3vrCqf93xM4TEdLZn1xa
                                                                                                                                                                                                  MD5:5390ADE0ED5428024F3D854B5B9BFE9F
                                                                                                                                                                                                  SHA1:DADA7B44887DCB7B77DCADB9690BAECF3EE2B937
                                                                                                                                                                                                  SHA-256:9771F09BE29BD7A69ABE774E28472A392382883C18A3CC524F8141E84B1BE22C
                                                                                                                                                                                                  SHA-512:92E82EFF79F45D4DE1CF27946A357F122C5337A85315D7C139458A1A6A51DFFBF3CBFCF832851FBDCD0EC1BD0F82E7089125FFBBE3275675433089BDDBFF865B
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                  C:\Users\user\Desktop\log.txt

                                                                                                                                                                                                  Download File
                                                                                                                                                                                                  Process:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                  Size (bytes):51
                                                                                                                                                                                                  Entropy (8bit):3.955095755197497
                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                  SSDEEP:3:kKUqgoZNqp5BQ9n:DUqg0M5BQ9n
                                                                                                                                                                                                  MD5:A1371419153814DB58116306AEF4C2A4
                                                                                                                                                                                                  SHA1:E1E3D7D7C0FD162A0D43B7126D1A1D76C2F187A1
                                                                                                                                                                                                  SHA-256:AADDFD0E5F30E2AD6D389BE3644BB7A5E01EC719DA0836CD55634B652E822182
                                                                                                                                                                                                  SHA-512:E17DCCF75857AEE98E2D5102EC1092281F44BF0D02558747C8777AEB6C69C3E3B92D08CC1EC44A1B19057D6D809B2AC49DA5893C8C167256071B380B8A0298F7
                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                  Preview:discord..TokenGrabber..discord start..Tokens done..

                                                                                                                                                                                                  Static File Info

                                                                                                                                                                                                  General

                                                                                                                                                                                                  File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                  Entropy (8bit):7.995665958424566
                                                                                                                                                                                                  TrID:
                                                                                                                                                                                                  • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                                                                                  • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                  • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                  File name:prank.exe
                                                                                                                                                                                                  File size:15'194'423 bytes
                                                                                                                                                                                                  MD5:8611679797f3e3c3778ae0831b38a4c0
                                                                                                                                                                                                  SHA1:2943bda7716f5f19f7c952413f263c31ee56604a
                                                                                                                                                                                                  SHA256:71dbbbeb418305a7a16464a0558113d8d1227ce3f16d22dfc9d902a18b9eb8a6
                                                                                                                                                                                                  SHA512:6b317b8e66828e6420975e80c51d78e5fe736d200eb82ba0e3a61c963cf6f412a17dc298872dbe6c67904b0bbd0fdfc4a41a8fac3f8fbd2766aaabfe6cd0902c
                                                                                                                                                                                                  SSDEEP:393216:+iIE7YoDUHk3mescGfdsYc2Pz21t/XYNk/yK3mkMII2:/7rDCaG5FsjE+/YLKWu
                                                                                                                                                                                                  TLSH:ECE63322E3581CA4DCA7543CC5C08479DB61BC6EA760878B12F055A31F9B4E87D7EFA2
                                                                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[c=.:.n.:.n.:.n.B.o.:.n.B.o^:.n.B.o.:.n.E.n.:.n.E.o.:.n.E.o.:.n.E.o.:.n.B.o.:.n.:.n.:.n...o.:.n...o.:.nRich.:.n........PE..d..

                                                                                                                                                                                                  File Icon

                                                                                                                                                                                                  Icon Hash:2e1e7c4c4c61e979

                                                                                                                                                                                                  Static PE Info

                                                                                                                                                                                                  General

                                                                                                                                                                                                  Entrypoint:0x14000b680
                                                                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                                                                  Digitally signed:false
                                                                                                                                                                                                  Imagebase:0x140000000
                                                                                                                                                                                                  Subsystem:windows cui
                                                                                                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                  DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                  Time Stamp:0x660AD4A3 [Mon Apr 1 15:37:07 2024 UTC]
                                                                                                                                                                                                  TLS Callbacks:
                                                                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                                                                  OS Version Major:5
                                                                                                                                                                                                  OS Version Minor:2
                                                                                                                                                                                                  File Version Major:5
                                                                                                                                                                                                  File Version Minor:2
                                                                                                                                                                                                  Subsystem Version Major:5
                                                                                                                                                                                                  Subsystem Version Minor:2
                                                                                                                                                                                                  Import Hash:bae3d3e8262d7ce7e9ee69cc1b630d3a

                                                                                                                                                                                                  Entrypoint Preview

                                                                                                                                                                                                  Instruction
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  sub esp, 28h
                                                                                                                                                                                                  call 00007F165C607A0Ch
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  add esp, 28h
                                                                                                                                                                                                  jmp 00007F165C60760Fh
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  sub esp, 28h
                                                                                                                                                                                                  call 00007F165C607F54h
                                                                                                                                                                                                  test eax, eax
                                                                                                                                                                                                  je 00007F165C6077C3h
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  mov eax, dword ptr [00000030h]
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                  jmp 00007F165C6077A7h
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  cmp ecx, eax
                                                                                                                                                                                                  je 00007F165C6077B6h
                                                                                                                                                                                                  xor eax, eax
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  cmpxchg dword ptr [00034DECh], ecx
                                                                                                                                                                                                  jne 00007F165C607790h
                                                                                                                                                                                                  xor al, al
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  add esp, 28h
                                                                                                                                                                                                  ret
                                                                                                                                                                                                  mov al, 01h
                                                                                                                                                                                                  jmp 00007F165C607799h
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  inc eax
                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  sub esp, 20h
                                                                                                                                                                                                  movzx eax, byte ptr [00034DD7h]
                                                                                                                                                                                                  test ecx, ecx
                                                                                                                                                                                                  mov ebx, 00000001h
                                                                                                                                                                                                  cmove eax, ebx
                                                                                                                                                                                                  mov byte ptr [00034DC7h], al
                                                                                                                                                                                                  call 00007F165C607D53h
                                                                                                                                                                                                  call 00007F165C608E82h
                                                                                                                                                                                                  test al, al
                                                                                                                                                                                                  jne 00007F165C6077A6h
                                                                                                                                                                                                  xor al, al
                                                                                                                                                                                                  jmp 00007F165C6077B6h
                                                                                                                                                                                                  call 00007F165C616B21h
                                                                                                                                                                                                  test al, al
                                                                                                                                                                                                  jne 00007F165C6077ABh
                                                                                                                                                                                                  xor ecx, ecx
                                                                                                                                                                                                  call 00007F165C608E92h
                                                                                                                                                                                                  jmp 00007F165C60778Ch
                                                                                                                                                                                                  mov al, bl
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  add esp, 20h
                                                                                                                                                                                                  pop ebx
                                                                                                                                                                                                  ret
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  int3
                                                                                                                                                                                                  inc eax
                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                  dec eax
                                                                                                                                                                                                  sub esp, 20h
                                                                                                                                                                                                  cmp byte ptr [00034D8Ch], 00000000h
                                                                                                                                                                                                  mov ebx, ecx
                                                                                                                                                                                                  jne 00007F165C607809h
                                                                                                                                                                                                  cmp ecx, 01h
                                                                                                                                                                                                  jnbe 00007F165C60780Ch
                                                                                                                                                                                                  call 00007F165C607EBAh
                                                                                                                                                                                                  test eax, eax
                                                                                                                                                                                                  je 00007F165C6077CAh

                                                                                                                                                                                                  Data Directories

                                                                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x3ccdc0x50.rdata
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000xef94.rsrc
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x420000x22c8.pdata
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x550000x75c.reloc
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x3a2500x1c.rdata
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3a1100x140.rdata
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x378.rdata
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                  Sections

                                                                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                  .text0x10000x29d400x29e00e66f2f95928939da653d981be7e60b7dFalse0.5513526119402985zlib compressed data6.495179691966694IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                  .rdata0x2b0000x129020x12a00614dbe65f7755137bfa964e719b0f30eFalse0.516935822147651data5.841791396607765IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                  .data0x3e0000x33380xe00033e0b425e93447b2ce3c4ec77bdc191False0.1328125Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 01.8240094210972881IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                  .pdata0x420000x22c80x2400f0abc814f732e2131394598ab622b584False0.4768880208333333data5.344107819904707IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                  _RDATA0x450000x15c0x2007e231eb5cdbe4ec938e06160e612ff6bFalse0.388671875data2.760474332344101IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                  .rsrc0x460000xef940xf000fbd2b5a5def79485726ab89b00be5dffFalse0.8011393229166667data7.350118925545914IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                  .reloc0x550000x75c0x80050e469e3d07609e6ff26b5103d72e931False0.5478515625data5.238533766219297IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                  Resources

                                                                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                  RT_ICON0x462080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.56636460554371
                                                                                                                                                                                                  RT_ICON0x470b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7287906137184116
                                                                                                                                                                                                  RT_ICON0x479580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.7471098265895953
                                                                                                                                                                                                  RT_ICON0x47ec00x909bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9971636186822983
                                                                                                                                                                                                  RT_ICON0x50f5c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.38309128630705397
                                                                                                                                                                                                  RT_ICON0x535040x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.4826454033771107
                                                                                                                                                                                                  RT_ICON0x545ac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.699468085106383
                                                                                                                                                                                                  RT_GROUP_ICON0x54a140x68data0.7019230769230769
                                                                                                                                                                                                  RT_MANIFEST0x54a7c0x518XML 1.0 document, ASCII text0.4700920245398773

                                                                                                                                                                                                  Imports

                                                                                                                                                                                                  DLLImport
                                                                                                                                                                                                  USER32.dllGetWindowThreadProcessId, ShowWindow
                                                                                                                                                                                                  KERNEL32.dllGetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, SetDllDirectoryW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, GetCurrentProcessId, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetConsoleWindow, HeapSize, GetLastError, WriteConsoleW, SetEndOfFile, GetStartupInfoW, TlsSetValue, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation
                                                                                                                                                                                                  ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                                  DNS Answers

                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                  Apr 10, 2024 08:36:59.808691025 CEST1.1.1.1192.168.2.40x2ee6No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                  Apr 10, 2024 08:36:59.808691025 CEST1.1.1.1192.168.2.40x2ee6No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                  Apr 10, 2024 08:37:00.663710117 CEST1.1.1.1192.168.2.40xba8No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                  Apr 10, 2024 08:37:00.663710117 CEST1.1.1.1192.168.2.40xba8No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

                                                                                                                                                                                                  Statistics

                                                                                                                                                                                                  CPU Usage

                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                  Memory Usage

                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                                  Behavior

                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                  System Behavior

                                                                                                                                                                                                  General

                                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                                  Start time:08:37:14
                                                                                                                                                                                                  Start date:10/04/2024
                                                                                                                                                                                                  Path:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\prank.exe"
                                                                                                                                                                                                  Imagebase:0x7ff736120000
                                                                                                                                                                                                  File size:15'194'423 bytes
                                                                                                                                                                                                  MD5 hash:8611679797F3E3C3778AE0831B38A4C0
                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                  General

                                                                                                                                                                                                  Target ID:1
                                                                                                                                                                                                  Start time:08:37:14
                                                                                                                                                                                                  Start date:10/04/2024
                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                  General

                                                                                                                                                                                                  Target ID:2
                                                                                                                                                                                                  Start time:08:37:16
                                                                                                                                                                                                  Start date:10/04/2024
                                                                                                                                                                                                  Path:C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\prank.exe"
                                                                                                                                                                                                  Imagebase:0x7ff736120000
                                                                                                                                                                                                  File size:15'194'423 bytes
                                                                                                                                                                                                  MD5 hash:8611679797F3E3C3778AE0831B38A4C0
                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                  Programmed in:Go lang
                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                  Disassembly

                                                                                                                                                                                                  Reset < >

                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                    Execution Coverage:11.2%
                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                    Signature Coverage:12.9%
                                                                                                                                                                                                    Total number of Nodes:2000
                                                                                                                                                                                                    Total number of Limit Nodes:35
                                                                                                                                                                                                    execution_graph 19229 7ff736141dc0 19240 7ff736147d54 19229->19240 19241 7ff736147d61 19240->19241 19242 7ff73613b07c __free_lconv_mon 11 API calls 19241->19242 19243 7ff736147d7d 19241->19243 19242->19241 19244 7ff73613b07c __free_lconv_mon 11 API calls 19243->19244 19245 7ff736141dc9 19243->19245 19244->19243 19246 7ff736140d58 EnterCriticalSection 19245->19246 18697 7ff736137fc0 18698 7ff736138027 18697->18698 18699 7ff736137fee 18697->18699 18698->18699 18701 7ff73613802c FindFirstFileExW 18698->18701 18700 7ff736137af8 memcpy_s 11 API calls 18699->18700 18702 7ff736137ff3 18700->18702 18703 7ff73613804e GetLastError 18701->18703 18704 7ff736138095 18701->18704 18705 7ff73613b014 _invalid_parameter_noinfo 37 API calls 18702->18705 18707 7ff736138059 18703->18707 18708 7ff736138085 18703->18708 18757 7ff736138230 18704->18757 18709 7ff736137ffe 18705->18709 18707->18708 18712 7ff736138075 18707->18712 18713 7ff736138063 18707->18713 18710 7ff736137af8 memcpy_s 11 API calls 18708->18710 18717 7ff73612b140 _wfindfirst32i64 8 API calls 18709->18717 18710->18709 18716 7ff736137af8 memcpy_s 11 API calls 18712->18716 18713->18708 18715 7ff736138068 18713->18715 18714 7ff736138230 _wfindfirst32i64 10 API calls 18718 7ff7361380bb 18714->18718 18720 7ff736137af8 memcpy_s 11 API calls 18715->18720 18716->18709 18721 7ff736138012 18717->18721 18719 7ff736138230 _wfindfirst32i64 10 API calls 18718->18719 18722 7ff7361380c9 18719->18722 18720->18709 18723 7ff736140ef4 _wfindfirst32i64 37 API calls 18722->18723 18724 7ff7361380e7 18723->18724 18724->18709 18725 7ff7361380f3 18724->18725 18726 7ff73613b034 _wfindfirst32i64 17 API calls 18725->18726 18727 7ff736138107 18726->18727 18728 7ff736138131 18727->18728 18730 7ff736138170 FindNextFileW 18727->18730 18729 7ff736137af8 memcpy_s 11 API calls 18728->18729 18731 7ff736138136 18729->18731 18732 7ff7361381c0 18730->18732 18733 7ff73613817f GetLastError 18730->18733 18734 7ff73613b014 _invalid_parameter_noinfo 37 API calls 18731->18734 18735 7ff736138230 _wfindfirst32i64 10 API calls 18732->18735 18736 7ff73613818a 18733->18736 18737 7ff7361381b3 18733->18737 18739 7ff736138141 18734->18739 18738 7ff7361381d8 18735->18738 18736->18737 18742 7ff7361381a6 18736->18742 18743 7ff736138194 18736->18743 18740 7ff736137af8 memcpy_s 11 API calls 18737->18740 18741 7ff736138230 _wfindfirst32i64 10 API calls 18738->18741 18744 7ff73612b140 _wfindfirst32i64 8 API calls 18739->18744 18740->18739 18745 7ff7361381e6 18741->18745 18747 7ff736137af8 memcpy_s 11 API calls 18742->18747 18743->18737 18746 7ff736138199 18743->18746 18748 7ff736138154 18744->18748 18749 7ff736138230 _wfindfirst32i64 10 API calls 18745->18749 18750 7ff736137af8 memcpy_s 11 API calls 18746->18750 18747->18739 18751 7ff7361381f4 18749->18751 18750->18739 18752 7ff736140ef4 _wfindfirst32i64 37 API calls 18751->18752 18753 7ff736138212 18752->18753 18753->18739 18754 7ff73613821a 18753->18754 18755 7ff73613b034 _wfindfirst32i64 17 API calls 18754->18755 18756 7ff73613822e 18755->18756 18758 7ff736138248 18757->18758 18759 7ff73613824e FileTimeToSystemTime 18757->18759 18758->18759 18762 7ff736138273 18758->18762 18760 7ff73613825d SystemTimeToTzSpecificLocalTime 18759->18760 18759->18762 18760->18762 18761 7ff73612b140 _wfindfirst32i64 8 API calls 18763 7ff7361380ad 18761->18763 18762->18761 18763->18714 18805 7ff73614ac42 18806 7ff73614ac5b 18805->18806 18807 7ff73614ac51 18805->18807 18809 7ff736140db8 LeaveCriticalSection 18807->18809 18816 7ff73613a450 18819 7ff73613a3cc 18816->18819 18826 7ff736140d58 EnterCriticalSection 18819->18826 18827 7ff736135320 18828 7ff73613532b 18827->18828 18836 7ff73613f8f4 18828->18836 18849 7ff736140d58 EnterCriticalSection 18836->18849 19524 7ff73614abad 19527 7ff736135388 LeaveCriticalSection 19524->19527 18867 7ff73614aa27 18868 7ff73614aa37 18867->18868 18871 7ff736135388 LeaveCriticalSection 18868->18871 15721 7ff73612b4fc 15742 7ff73612b6dc 15721->15742 15724 7ff73612b51d __scrt_acquire_startup_lock 15727 7ff73612b65d 15724->15727 15733 7ff73612b53b __scrt_release_startup_lock 15724->15733 15725 7ff73612b653 15861 7ff73612ba0c IsProcessorFeaturePresent 15725->15861 15728 7ff73612ba0c 7 API calls 15727->15728 15730 7ff73612b668 __CxxCallCatchBlock 15728->15730 15729 7ff73612b560 15731 7ff73612b5e6 15750 7ff736139e80 15731->15750 15733->15729 15733->15731 15850 7ff73613a22c 15733->15850 15735 7ff73612b5eb 15756 7ff736121000 15735->15756 15740 7ff73612b60f 15740->15730 15857 7ff73612b870 15740->15857 15868 7ff73612bcac 15742->15868 15745 7ff73612b515 15745->15724 15745->15725 15746 7ff73612b70b 15870 7ff73613aa8c 15746->15870 15751 7ff736139e90 15750->15751 15754 7ff736139ea5 15750->15754 15751->15754 15913 7ff736139910 15751->15913 15754->15735 15757 7ff736121011 15756->15757 15982 7ff7361278c0 15757->15982 15759 7ff736121023 15989 7ff736135f6c 15759->15989 15761 7ff736122aa0 15996 7ff736121e50 15761->15996 15764 7ff736122b96 15766 7ff73612b140 _wfindfirst32i64 8 API calls 15764->15766 15767 7ff736122baa 15766->15767 15855 7ff73612bb60 GetModuleHandleW 15767->15855 15768 7ff736122abf 15768->15764 16012 7ff736126d10 15768->16012 15770 7ff736122aec 15771 7ff736122b37 15770->15771 15772 7ff736126d10 92 API calls 15770->15772 16027 7ff7361271f0 15771->16027 15777 7ff736122b0c __std_exception_destroy 15772->15777 15774 7ff736122b4c 16031 7ff736121c50 15774->16031 15777->15771 15780 7ff7361271f0 89 API calls 15777->15780 15778 7ff736121c50 121 API calls 15779 7ff736122b7a 15778->15779 15781 7ff736122b7e 15779->15781 15782 7ff736122bc5 15779->15782 15780->15771 16137 7ff736121fb0 15781->16137 15784 7ff736122c3e 15782->15784 16143 7ff736123150 15782->16143 15783 7ff736122c6d 15786 7ff736122cab 15783->15786 16055 7ff7361214f0 15783->16055 15784->15783 15792 7ff736122c68 15784->15792 15793 7ff736122c6f 15784->15793 15786->15764 15790 7ff736122d06 15786->15790 16062 7ff736127f60 15786->16062 16076 7ff736125f90 15790->16076 16050 7ff736127a60 GetConsoleWindow 15792->16050 15793->15783 15803 7ff736122c82 15793->15803 15795 7ff736122ce3 15798 7ff736122ce8 15795->15798 15799 7ff736122cf9 SetDllDirectoryW 15795->15799 15802 7ff736121fb0 86 API calls 15798->15802 15799->15790 15801 7ff736122c11 15801->15784 15806 7ff736122c16 15801->15806 15802->15764 16166 7ff736127bb0 GetConsoleWindow 15803->16166 15804 7ff736121fb0 86 API calls 15804->15764 15805 7ff736122d52 15811 7ff736122e4d 15805->15811 15817 7ff736122d71 15805->15817 16162 7ff73612f5fc 15806->16162 15810 7ff736122be3 15810->15804 16080 7ff736122680 15811->16080 15812 7ff736122d20 15812->15805 16180 7ff7361257a0 15812->16180 15824 7ff736122db5 15817->15824 16215 7ff736121e90 15817->16215 15818 7ff736122d54 15821 7ff7361259f0 FreeLibrary 15818->15821 15820 7ff736122dfe 16219 7ff736122620 15820->16219 15821->15805 15824->15764 15824->15820 15831 7ff736122df9 15824->15831 15832 7ff736122e00 15824->15832 15826 7ff736122e75 15827 7ff736126d10 92 API calls 15826->15827 15835 7ff736122e81 15827->15835 15828 7ff736122d43 16209 7ff736125de0 15828->16209 15834 7ff736127a60 4 API calls 15831->15834 15832->15820 15837 7ff736122e13 15832->15837 15833 7ff736122e28 15839 7ff7361259f0 FreeLibrary 15833->15839 15834->15820 15836 7ff736122ea3 15835->15836 15843 7ff736122e9e 15835->15843 15844 7ff736122ea5 15835->15844 16094 7ff736127230 15836->16094 15840 7ff736127bb0 4 API calls 15837->15840 15839->15764 15840->15820 15845 7ff736127a60 4 API calls 15843->15845 15844->15836 15846 7ff736122eb8 15844->15846 15845->15836 15848 7ff736127bb0 4 API calls 15846->15848 15848->15836 15851 7ff73613a264 15850->15851 15852 7ff73613a243 15850->15852 18605 7ff73613aad8 15851->18605 15852->15731 15856 7ff73612bb71 15855->15856 15856->15740 15859 7ff73612b881 15857->15859 15858 7ff73612b626 15858->15729 15859->15858 15860 7ff73612ce08 __scrt_initialize_crt 7 API calls 15859->15860 15860->15858 15862 7ff73612ba32 _wfindfirst32i64 memcpy_s 15861->15862 15863 7ff73612ba51 RtlCaptureContext RtlLookupFunctionEntry 15862->15863 15864 7ff73612ba7a RtlVirtualUnwind 15863->15864 15865 7ff73612bab6 memcpy_s 15863->15865 15864->15865 15866 7ff73612bae8 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15865->15866 15867 7ff73612bb3a _wfindfirst32i64 15866->15867 15867->15727 15869 7ff73612b6fe __scrt_dllmain_crt_thread_attach 15868->15869 15869->15745 15869->15746 15871 7ff736143bbc 15870->15871 15872 7ff73612b710 15871->15872 15880 7ff73613cc50 15871->15880 15872->15745 15874 7ff73612ce08 15872->15874 15875 7ff73612ce1a 15874->15875 15876 7ff73612ce10 15874->15876 15875->15745 15892 7ff73612d184 15876->15892 15891 7ff736140d58 EnterCriticalSection 15880->15891 15893 7ff73612ce15 15892->15893 15894 7ff73612d193 15892->15894 15896 7ff73612d1f0 15893->15896 15900 7ff73612d3c0 15894->15900 15897 7ff73612d21b 15896->15897 15898 7ff73612d1fe DeleteCriticalSection 15897->15898 15899 7ff73612d21f 15897->15899 15898->15897 15899->15875 15904 7ff73612d228 15900->15904 15905 7ff73612d342 TlsFree 15904->15905 15910 7ff73612d26c __vcrt_FlsAlloc 15904->15910 15906 7ff73612d29a LoadLibraryExW 15907 7ff73612d2bb GetLastError 15906->15907 15908 7ff73612d311 15906->15908 15907->15910 15909 7ff73612d331 GetProcAddress 15908->15909 15911 7ff73612d328 FreeLibrary 15908->15911 15909->15905 15910->15905 15910->15906 15910->15909 15912 7ff73612d2dd LoadLibraryExW 15910->15912 15911->15909 15912->15908 15912->15910 15914 7ff736139929 15913->15914 15925 7ff736139925 15913->15925 15934 7ff73614314c GetEnvironmentStringsW 15914->15934 15917 7ff736139942 15941 7ff736139a90 15917->15941 15918 7ff736139936 15919 7ff73613b07c __free_lconv_mon 11 API calls 15918->15919 15919->15925 15922 7ff73613b07c __free_lconv_mon 11 API calls 15923 7ff736139969 15922->15923 15924 7ff73613b07c __free_lconv_mon 11 API calls 15923->15924 15924->15925 15925->15754 15926 7ff736139cd0 15925->15926 15927 7ff736139cf3 15926->15927 15932 7ff736139d0a 15926->15932 15927->15754 15928 7ff73613f2e0 memcpy_s 11 API calls 15928->15932 15929 7ff736139d7e 15931 7ff73613b07c __free_lconv_mon 11 API calls 15929->15931 15930 7ff73613fca0 MultiByteToWideChar _fread_nolock 15930->15932 15931->15927 15932->15927 15932->15928 15932->15929 15932->15930 15933 7ff73613b07c __free_lconv_mon 11 API calls 15932->15933 15933->15932 15935 7ff736143170 15934->15935 15936 7ff73613992e 15934->15936 15960 7ff73613dd2c 15935->15960 15936->15917 15936->15918 15938 7ff7361431a7 memcpy_s 15939 7ff73613b07c __free_lconv_mon 11 API calls 15938->15939 15940 7ff7361431c7 FreeEnvironmentStringsW 15939->15940 15940->15936 15942 7ff736139ab8 15941->15942 15943 7ff73613f2e0 memcpy_s 11 API calls 15942->15943 15956 7ff736139af3 15943->15956 15944 7ff736139afb 15945 7ff73613b07c __free_lconv_mon 11 API calls 15944->15945 15947 7ff73613994a 15945->15947 15946 7ff736139b75 15948 7ff73613b07c __free_lconv_mon 11 API calls 15946->15948 15947->15922 15948->15947 15949 7ff73613f2e0 memcpy_s 11 API calls 15949->15956 15950 7ff736139b64 15976 7ff736139bac 15950->15976 15954 7ff73613b07c __free_lconv_mon 11 API calls 15954->15944 15955 7ff736139b98 15957 7ff73613b034 _wfindfirst32i64 17 API calls 15955->15957 15956->15944 15956->15946 15956->15949 15956->15950 15956->15955 15958 7ff73613b07c __free_lconv_mon 11 API calls 15956->15958 15967 7ff736140ef4 15956->15967 15959 7ff736139baa 15957->15959 15958->15956 15961 7ff73613dd77 15960->15961 15966 7ff73613dd3b memcpy_s 15960->15966 15963 7ff736137af8 memcpy_s 11 API calls 15961->15963 15962 7ff73613dd5e RtlAllocateHeap 15964 7ff73613dd75 15962->15964 15962->15966 15963->15964 15964->15938 15965 7ff736143ca0 memcpy_s 2 API calls 15965->15966 15966->15961 15966->15962 15966->15965 15968 7ff736140f0b 15967->15968 15969 7ff736140f01 15967->15969 15970 7ff736137af8 memcpy_s 11 API calls 15968->15970 15969->15968 15974 7ff736140f27 15969->15974 15971 7ff736140f13 15970->15971 15972 7ff73613b014 _invalid_parameter_noinfo 37 API calls 15971->15972 15973 7ff736140f1f 15972->15973 15973->15956 15974->15973 15975 7ff736137af8 memcpy_s 11 API calls 15974->15975 15975->15971 15977 7ff736139b6c 15976->15977 15978 7ff736139bb1 15976->15978 15977->15954 15979 7ff736139bda 15978->15979 15980 7ff73613b07c __free_lconv_mon 11 API calls 15978->15980 15981 7ff73613b07c __free_lconv_mon 11 API calls 15979->15981 15980->15978 15981->15977 15984 7ff7361278df 15982->15984 15983 7ff736127930 WideCharToMultiByte 15983->15984 15986 7ff7361279d6 15983->15986 15984->15983 15984->15986 15987 7ff736127984 WideCharToMultiByte 15984->15987 15988 7ff7361278e7 __std_exception_destroy 15984->15988 16246 7ff736122010 15986->16246 15987->15984 15987->15986 15988->15759 15990 7ff7361400f0 15989->15990 15992 7ff736140196 15990->15992 15993 7ff736140143 15990->15993 15991 7ff73613af48 _invalid_parameter_noinfo 37 API calls 15995 7ff73614016c 15991->15995 16596 7ff73613ffc8 15992->16596 15993->15991 15995->15761 15997 7ff736121e65 15996->15997 15998 7ff736121e80 15997->15998 16604 7ff736121f70 15997->16604 15998->15764 16000 7ff736123040 15998->16000 16627 7ff73612b0e0 16000->16627 16003 7ff73612307b 16005 7ff736122010 86 API calls 16003->16005 16004 7ff736123092 16629 7ff736128070 16004->16629 16011 7ff73612308e 16005->16011 16008 7ff736121fb0 86 API calls 16008->16011 16009 7ff73612b140 _wfindfirst32i64 8 API calls 16010 7ff7361230cf 16009->16010 16010->15768 16011->16009 16013 7ff736126d1a 16012->16013 16014 7ff736127f60 88 API calls 16013->16014 16015 7ff736126d3c GetEnvironmentVariableW 16014->16015 16016 7ff736126d54 ExpandEnvironmentStringsW 16015->16016 16017 7ff736126da6 16015->16017 16019 7ff736128070 88 API calls 16016->16019 16018 7ff73612b140 _wfindfirst32i64 8 API calls 16017->16018 16020 7ff736126db8 16018->16020 16021 7ff736126d7c 16019->16021 16020->15770 16021->16017 16022 7ff736126d86 16021->16022 16640 7ff73613ab0c 16022->16640 16025 7ff73612b140 _wfindfirst32i64 8 API calls 16026 7ff736126d9e 16025->16026 16026->15770 16028 7ff736127f60 88 API calls 16027->16028 16029 7ff736127207 SetEnvironmentVariableW 16028->16029 16030 7ff73612721f __std_exception_destroy 16029->16030 16030->15774 16032 7ff736121c5e 16031->16032 16033 7ff736121e90 49 API calls 16032->16033 16034 7ff736121c94 16033->16034 16035 7ff736121e90 49 API calls 16034->16035 16044 7ff736121d7e 16034->16044 16036 7ff736121cba 16035->16036 16036->16044 16647 7ff736121a40 16036->16647 16037 7ff73612b140 _wfindfirst32i64 8 API calls 16038 7ff736121e0c 16037->16038 16038->15778 16038->15784 16042 7ff736121d6c 16043 7ff736122fc0 49 API calls 16042->16043 16043->16044 16044->16037 16045 7ff736121d2f 16045->16042 16046 7ff736121dd4 16045->16046 16047 7ff736122fc0 49 API calls 16046->16047 16048 7ff736121de1 16047->16048 16683 7ff7361231d0 16048->16683 16051 7ff736127aa4 16050->16051 16052 7ff736127a74 GetCurrentProcessId GetWindowThreadProcessId 16050->16052 16051->15783 16052->16051 16053 7ff736127a93 16052->16053 16053->16051 16054 7ff736127a99 ShowWindow 16053->16054 16054->16051 16056 7ff73612157f 16055->16056 16058 7ff736121506 16055->16058 16056->15786 16725 7ff736126b00 16058->16725 16060 7ff736121fb0 86 API calls 16061 7ff736121564 16060->16061 16061->15786 16063 7ff736128007 MultiByteToWideChar 16062->16063 16064 7ff736127f81 MultiByteToWideChar 16062->16064 16067 7ff73612802a 16063->16067 16068 7ff73612804f 16063->16068 16065 7ff736127fa7 16064->16065 16066 7ff736127fcc 16064->16066 16070 7ff736122010 86 API calls 16065->16070 16066->16063 16073 7ff736127fe2 16066->16073 16069 7ff736122010 86 API calls 16067->16069 16068->15795 16071 7ff73612803d 16069->16071 16072 7ff736127fba 16070->16072 16071->15795 16072->15795 16074 7ff736122010 86 API calls 16073->16074 16075 7ff736127ff5 16074->16075 16075->15795 16077 7ff736125fa5 16076->16077 16078 7ff736122d0b 16077->16078 16079 7ff736121f70 86 API calls 16077->16079 16078->15805 16171 7ff736125c40 16078->16171 16079->16078 16084 7ff7361226f3 16080->16084 16086 7ff736122734 16080->16086 16081 7ff73612b140 _wfindfirst32i64 8 API calls 16082 7ff736122785 16081->16082 16082->15764 16087 7ff736127180 16082->16087 16084->16086 17259 7ff736121710 16084->17259 17301 7ff736122130 16084->17301 16086->16081 16088 7ff736127f60 88 API calls 16087->16088 16089 7ff73612719f 16088->16089 16090 7ff736127f60 88 API calls 16089->16090 16091 7ff7361271af 16090->16091 16092 7ff736137f60 38 API calls 16091->16092 16093 7ff7361271bd __std_exception_destroy 16092->16093 16093->15826 16095 7ff736127240 16094->16095 16096 7ff736127f60 88 API calls 16095->16096 16097 7ff736127271 SetConsoleCtrlHandler GetStartupInfoW 16096->16097 16098 7ff7361272d2 16097->16098 17767 7ff73613ab84 16098->17767 16138 7ff736121fce 16137->16138 16139 7ff736121ef0 78 API calls 16138->16139 16140 7ff736121fec 16139->16140 16141 7ff736122060 86 API calls 16140->16141 16142 7ff736121ffb 16141->16142 16142->15764 16144 7ff73612315c 16143->16144 16145 7ff736127f60 88 API calls 16144->16145 16146 7ff736123187 16145->16146 16147 7ff736127f60 88 API calls 16146->16147 16148 7ff73612319a 16147->16148 17823 7ff7361365a8 16148->17823 16151 7ff73612b140 _wfindfirst32i64 8 API calls 16152 7ff736122bdb 16151->16152 16152->15810 16153 7ff736127460 16152->16153 16154 7ff736127484 16153->16154 16155 7ff73612fc84 73 API calls 16154->16155 16158 7ff73612755b __std_exception_destroy 16154->16158 16156 7ff73612749e 16155->16156 16156->16158 18202 7ff7361391e4 16156->18202 16158->15801 16159 7ff73612fc84 73 API calls 16161 7ff7361274b3 16159->16161 16160 7ff73612f94c _fread_nolock 53 API calls 16160->16161 16161->16158 16161->16159 16161->16160 16163 7ff73612f62c 16162->16163 18217 7ff73612f3d8 16163->18217 16165 7ff73612f645 16165->15810 16167 7ff736127bf7 16166->16167 16168 7ff736127bc4 GetCurrentProcessId GetWindowThreadProcessId 16166->16168 16167->15783 16168->16167 16169 7ff736127be3 16168->16169 16169->16167 16170 7ff736127be9 ShowWindow 16169->16170 16170->16167 16172 7ff736125c7a 16171->16172 16173 7ff736125c63 16171->16173 16172->15812 16173->16172 18228 7ff7361215a0 16173->18228 16175 7ff736125c84 16175->16172 16176 7ff7361231d0 49 API calls 16175->16176 16177 7ff736125ce5 16176->16177 16178 7ff736121fb0 86 API calls 16177->16178 16179 7ff736125d55 memcpy_s __std_exception_destroy 16177->16179 16178->16172 16179->15812 16193 7ff7361257ba memcpy_s 16180->16193 16181 7ff7361258df 16183 7ff7361231d0 49 API calls 16181->16183 16182 7ff7361258fb 16184 7ff736121fb0 86 API calls 16182->16184 16185 7ff736125958 16183->16185 16190 7ff7361258f1 __std_exception_destroy 16184->16190 16188 7ff7361231d0 49 API calls 16185->16188 16186 7ff7361231d0 49 API calls 16186->16193 16187 7ff7361258c0 16187->16181 16191 7ff7361231d0 49 API calls 16187->16191 16189 7ff736125988 16188->16189 16195 7ff7361231d0 49 API calls 16189->16195 16192 7ff73612b140 _wfindfirst32i64 8 API calls 16190->16192 16191->16181 16194 7ff736122d31 16192->16194 16193->16181 16193->16182 16193->16186 16193->16187 16196 7ff736121710 140 API calls 16193->16196 16197 7ff7361258e1 16193->16197 16194->15818 16199 7ff736125720 16194->16199 16195->16190 16196->16193 16198 7ff736121fb0 86 API calls 16197->16198 16198->16190 18252 7ff736127410 16199->18252 16201 7ff73612573c 16202 7ff736127410 89 API calls 16201->16202 16203 7ff73612574f 16202->16203 16204 7ff736125785 16203->16204 16206 7ff736125767 16203->16206 16205 7ff736121fb0 86 API calls 16204->16205 16207 7ff736122d3f 16205->16207 18256 7ff7361260a0 GetProcAddress 16206->18256 16207->15818 16207->15828 16210 7ff736125e04 16209->16210 16211 7ff736125e7a 16210->16211 16212 7ff736121fb0 86 API calls 16210->16212 16211->15805 16213 7ff736125e5e 16212->16213 16214 7ff7361259f0 FreeLibrary 16213->16214 16214->16211 16216 7ff736121eb5 16215->16216 16217 7ff736134c70 49 API calls 16216->16217 16218 7ff736121ed8 16217->16218 16218->15824 18315 7ff736124d70 16219->18315 16222 7ff73612266d 16222->15833 16224 7ff736122644 16224->16222 18384 7ff736124ad0 16224->18384 16226 7ff736122650 16226->16222 16253 7ff736122060 16246->16253 16254 7ff736122070 16253->16254 16278 7ff736134c70 16254->16278 16258 7ff7361220d0 16311 7ff736121ef0 16258->16311 16261 7ff73612b140 _wfindfirst32i64 8 API calls 16262 7ff736122037 GetLastError 16261->16262 16263 7ff736127770 16262->16263 16264 7ff73612777c 16263->16264 16265 7ff736127797 GetLastError 16264->16265 16266 7ff73612779d FormatMessageW 16264->16266 16265->16266 16267 7ff7361277ec WideCharToMultiByte 16266->16267 16268 7ff7361277d0 16266->16268 16269 7ff7361277e3 16267->16269 16270 7ff736127826 16267->16270 16271 7ff736122010 83 API calls 16268->16271 16273 7ff73612b140 _wfindfirst32i64 8 API calls 16269->16273 16272 7ff736122010 83 API calls 16270->16272 16271->16269 16272->16269 16274 7ff736122044 16273->16274 16275 7ff736121f40 16274->16275 16276 7ff736122060 86 API calls 16275->16276 16277 7ff736121f62 16276->16277 16277->15988 16279 7ff736134cca 16278->16279 16280 7ff736134cef 16279->16280 16282 7ff736134d2b 16279->16282 16281 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16280->16281 16285 7ff736134d19 16281->16285 16315 7ff7361326b4 16282->16315 16284 7ff736134e08 16287 7ff73613b07c __free_lconv_mon 11 API calls 16284->16287 16286 7ff73612b140 _wfindfirst32i64 8 API calls 16285->16286 16288 7ff7361220b8 16286->16288 16287->16285 16296 7ff736127da0 MultiByteToWideChar 16288->16296 16290 7ff736134ddd 16293 7ff73613b07c __free_lconv_mon 11 API calls 16290->16293 16291 7ff736134e2c 16291->16284 16292 7ff736134e36 16291->16292 16295 7ff73613b07c __free_lconv_mon 11 API calls 16292->16295 16293->16285 16294 7ff736134dd4 16294->16284 16294->16290 16295->16285 16297 7ff736127dec 16296->16297 16298 7ff736127e06 16296->16298 16299 7ff736122010 82 API calls 16297->16299 16300 7ff736127e1b 16298->16300 16301 7ff736127e35 MultiByteToWideChar 16298->16301 16310 7ff736127dff __std_exception_destroy 16299->16310 16302 7ff736122010 82 API calls 16300->16302 16303 7ff736127e58 16301->16303 16304 7ff736127e72 WideCharToMultiByte 16301->16304 16302->16310 16305 7ff736122010 82 API calls 16303->16305 16306 7ff736127ea8 16304->16306 16308 7ff736127e9f 16304->16308 16305->16310 16307 7ff736127ecd WideCharToMultiByte 16306->16307 16306->16308 16307->16308 16307->16310 16309 7ff736122010 82 API calls 16308->16309 16309->16310 16310->16258 16312 7ff736121f16 16311->16312 16581 7ff736134b4c 16312->16581 16314 7ff736121f2c 16314->16261 16316 7ff7361326f2 16315->16316 16317 7ff7361326e2 16315->16317 16318 7ff7361326fb 16316->16318 16325 7ff736132729 16316->16325 16320 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16317->16320 16321 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16318->16321 16319 7ff736132721 16319->16284 16319->16290 16319->16291 16319->16294 16320->16319 16321->16319 16324 7ff7361329d8 16327 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16324->16327 16325->16317 16325->16319 16325->16324 16329 7ff736133604 16325->16329 16355 7ff736132e94 16325->16355 16385 7ff7361321fc 16325->16385 16388 7ff736134820 16325->16388 16327->16317 16330 7ff7361336b9 16329->16330 16331 7ff736133646 16329->16331 16334 7ff7361336be 16330->16334 16335 7ff736133713 16330->16335 16332 7ff73613364c 16331->16332 16333 7ff7361336e3 16331->16333 16342 7ff736133651 16332->16342 16346 7ff736133722 16332->16346 16412 7ff736131140 16333->16412 16336 7ff7361336c0 16334->16336 16337 7ff7361336f3 16334->16337 16335->16333 16335->16346 16353 7ff73613367c 16335->16353 16339 7ff736133661 16336->16339 16345 7ff7361336cf 16336->16345 16419 7ff736130d30 16337->16419 16354 7ff736133751 16339->16354 16394 7ff736133f68 16339->16394 16342->16339 16344 7ff736133694 16342->16344 16342->16353 16344->16354 16404 7ff736134424 16344->16404 16345->16333 16348 7ff7361336d4 16345->16348 16346->16354 16426 7ff736131550 16346->16426 16348->16354 16408 7ff7361345bc 16348->16408 16349 7ff73612b140 _wfindfirst32i64 8 API calls 16351 7ff7361339e7 16349->16351 16351->16325 16353->16354 16433 7ff73613ef88 16353->16433 16354->16349 16356 7ff736132e9f 16355->16356 16357 7ff736132eb5 16355->16357 16358 7ff7361336b9 16356->16358 16359 7ff736133646 16356->16359 16360 7ff736132ef3 16356->16360 16357->16360 16361 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16357->16361 16364 7ff7361336be 16358->16364 16365 7ff736133713 16358->16365 16362 7ff73613364c 16359->16362 16363 7ff7361336e3 16359->16363 16360->16325 16361->16360 16373 7ff736133651 16362->16373 16375 7ff736133722 16362->16375 16368 7ff736131140 38 API calls 16363->16368 16366 7ff7361336c0 16364->16366 16367 7ff7361336f3 16364->16367 16365->16363 16369 7ff73613367c 16365->16369 16365->16375 16370 7ff736133661 16366->16370 16377 7ff7361336cf 16366->16377 16371 7ff736130d30 38 API calls 16367->16371 16368->16369 16383 7ff73613ef88 47 API calls 16369->16383 16384 7ff736133751 16369->16384 16372 7ff736133f68 47 API calls 16370->16372 16370->16384 16371->16369 16372->16369 16373->16369 16373->16370 16374 7ff736133694 16373->16374 16378 7ff736134424 47 API calls 16374->16378 16374->16384 16376 7ff736131550 38 API calls 16375->16376 16375->16384 16376->16369 16377->16363 16379 7ff7361336d4 16377->16379 16378->16369 16381 7ff7361345bc 37 API calls 16379->16381 16379->16384 16380 7ff73612b140 _wfindfirst32i64 8 API calls 16382 7ff7361339e7 16380->16382 16381->16369 16382->16325 16383->16369 16384->16380 16518 7ff736130304 16385->16518 16389 7ff736134837 16388->16389 16535 7ff73613e0e8 16389->16535 16395 7ff736133f8a 16394->16395 16443 7ff736130170 16395->16443 16400 7ff736134820 45 API calls 16402 7ff7361340c7 16400->16402 16401 7ff736134820 45 API calls 16403 7ff736134150 16401->16403 16402->16401 16402->16402 16402->16403 16403->16353 16405 7ff73613443c 16404->16405 16407 7ff7361344a4 16404->16407 16406 7ff73613ef88 47 API calls 16405->16406 16405->16407 16406->16407 16407->16353 16411 7ff7361345dd 16408->16411 16409 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16410 7ff73613460e 16409->16410 16410->16353 16411->16409 16411->16410 16413 7ff736131173 16412->16413 16414 7ff7361311a2 16413->16414 16416 7ff73613125f 16413->16416 16415 7ff736130170 12 API calls 16414->16415 16418 7ff7361311df 16414->16418 16415->16418 16417 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16416->16417 16417->16418 16418->16353 16420 7ff736130d63 16419->16420 16421 7ff736130d92 16420->16421 16423 7ff736130e4f 16420->16423 16422 7ff736130170 12 API calls 16421->16422 16425 7ff736130dcf 16421->16425 16422->16425 16424 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16423->16424 16424->16425 16425->16353 16427 7ff736131583 16426->16427 16428 7ff7361315b2 16427->16428 16430 7ff73613166f 16427->16430 16429 7ff736130170 12 API calls 16428->16429 16432 7ff7361315ef 16428->16432 16429->16432 16431 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16430->16431 16431->16432 16432->16353 16434 7ff73613efb0 16433->16434 16435 7ff73613eff5 16434->16435 16436 7ff736134820 45 API calls 16434->16436 16438 7ff73613efb5 memcpy_s 16434->16438 16442 7ff73613efde memcpy_s 16434->16442 16435->16438 16435->16442 16515 7ff736140568 16435->16515 16436->16435 16437 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16437->16438 16438->16353 16442->16437 16442->16438 16444 7ff736130196 16443->16444 16445 7ff7361301a7 16443->16445 16451 7ff73613eca0 16444->16451 16445->16444 16446 7ff73613dd2c _fread_nolock 12 API calls 16445->16446 16447 7ff7361301d4 16446->16447 16448 7ff7361301e8 16447->16448 16449 7ff73613b07c __free_lconv_mon 11 API calls 16447->16449 16450 7ff73613b07c __free_lconv_mon 11 API calls 16448->16450 16449->16448 16450->16444 16452 7ff73613ecbd 16451->16452 16453 7ff73613ecf0 16451->16453 16454 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16452->16454 16453->16452 16455 7ff73613ed22 16453->16455 16464 7ff7361340a5 16454->16464 16460 7ff73613ee35 16455->16460 16468 7ff73613ed6a 16455->16468 16456 7ff73613ef27 16506 7ff73613e18c 16456->16506 16458 7ff73613eeed 16499 7ff73613e524 16458->16499 16460->16456 16460->16458 16461 7ff73613eebc 16460->16461 16463 7ff73613ee7f 16460->16463 16466 7ff73613ee75 16460->16466 16492 7ff73613e804 16461->16492 16482 7ff73613ea34 16463->16482 16464->16400 16464->16402 16466->16458 16467 7ff73613ee7a 16466->16467 16467->16461 16467->16463 16468->16464 16473 7ff73613abac 16468->16473 16471 7ff73613b034 _wfindfirst32i64 17 API calls 16472 7ff73613ef84 16471->16472 16474 7ff73613abb9 16473->16474 16475 7ff73613abc3 16473->16475 16474->16475 16480 7ff73613abde 16474->16480 16476 7ff736137af8 memcpy_s 11 API calls 16475->16476 16477 7ff73613abca 16476->16477 16478 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16477->16478 16479 7ff73613abd6 16478->16479 16479->16464 16479->16471 16480->16479 16481 7ff736137af8 memcpy_s 11 API calls 16480->16481 16481->16477 16483 7ff7361447bc 38 API calls 16482->16483 16484 7ff73613ea81 16483->16484 16485 7ff736144204 37 API calls 16484->16485 16486 7ff73613eadc 16485->16486 16487 7ff73613eae0 16486->16487 16488 7ff73613eb31 16486->16488 16490 7ff73613eafc 16486->16490 16487->16464 16489 7ff73613e620 45 API calls 16488->16489 16489->16487 16491 7ff73613e8dc 45 API calls 16490->16491 16491->16487 16493 7ff7361447bc 38 API calls 16492->16493 16494 7ff73613e84e 16493->16494 16495 7ff736144204 37 API calls 16494->16495 16496 7ff73613e89e 16495->16496 16497 7ff73613e8a2 16496->16497 16498 7ff73613e8dc 45 API calls 16496->16498 16497->16464 16498->16497 16500 7ff7361447bc 38 API calls 16499->16500 16501 7ff73613e56f 16500->16501 16502 7ff736144204 37 API calls 16501->16502 16503 7ff73613e5c7 16502->16503 16504 7ff73613e5cb 16503->16504 16505 7ff73613e620 45 API calls 16503->16505 16504->16464 16505->16504 16507 7ff73613e1d1 16506->16507 16508 7ff73613e204 16506->16508 16509 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16507->16509 16510 7ff73613e21c 16508->16510 16512 7ff73613e29d 16508->16512 16514 7ff73613e1fd memcpy_s 16509->16514 16511 7ff73613e524 46 API calls 16510->16511 16511->16514 16513 7ff736134820 45 API calls 16512->16513 16512->16514 16513->16514 16514->16464 16517 7ff73614058c WideCharToMultiByte 16515->16517 16519 7ff736130331 16518->16519 16520 7ff736130343 16518->16520 16521 7ff736137af8 memcpy_s 11 API calls 16519->16521 16522 7ff736130350 16520->16522 16526 7ff73613038d 16520->16526 16523 7ff736130336 16521->16523 16524 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16522->16524 16525 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16523->16525 16532 7ff736130341 16524->16532 16525->16532 16527 7ff736130436 16526->16527 16528 7ff736137af8 memcpy_s 11 API calls 16526->16528 16529 7ff736137af8 memcpy_s 11 API calls 16527->16529 16527->16532 16530 7ff73613042b 16528->16530 16531 7ff7361304e0 16529->16531 16533 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16530->16533 16534 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16531->16534 16532->16325 16533->16527 16534->16532 16536 7ff73613485f 16535->16536 16537 7ff73613e101 16535->16537 16539 7ff73613e154 16536->16539 16537->16536 16543 7ff736143a14 16537->16543 16540 7ff73613e16d 16539->16540 16541 7ff73613486f 16539->16541 16540->16541 16578 7ff736142d60 16540->16578 16541->16325 16555 7ff73613b880 GetLastError 16543->16555 16546 7ff736143a6e 16546->16536 16556 7ff73613b8c1 FlsSetValue 16555->16556 16557 7ff73613b8a4 FlsGetValue 16555->16557 16559 7ff73613b8d3 16556->16559 16575 7ff73613b8b1 16556->16575 16558 7ff73613b8bb 16557->16558 16557->16575 16558->16556 16561 7ff73613f2e0 memcpy_s 11 API calls 16559->16561 16560 7ff73613b92d SetLastError 16562 7ff73613b93a 16560->16562 16563 7ff73613b94d 16560->16563 16564 7ff73613b8e2 16561->16564 16562->16546 16577 7ff736140d58 EnterCriticalSection 16562->16577 16565 7ff73613ac0c __CxxCallCatchBlock 38 API calls 16563->16565 16566 7ff73613b900 FlsSetValue 16564->16566 16567 7ff73613b8f0 FlsSetValue 16564->16567 16570 7ff73613b952 16565->16570 16568 7ff73613b91e 16566->16568 16569 7ff73613b90c FlsSetValue 16566->16569 16571 7ff73613b8f9 16567->16571 16572 7ff73613b628 memcpy_s 11 API calls 16568->16572 16569->16571 16573 7ff73613b07c __free_lconv_mon 11 API calls 16571->16573 16574 7ff73613b926 16572->16574 16573->16575 16576 7ff73613b07c __free_lconv_mon 11 API calls 16574->16576 16575->16560 16576->16560 16579 7ff73613b880 __CxxCallCatchBlock 45 API calls 16578->16579 16580 7ff736142d69 16579->16580 16582 7ff736134b76 16581->16582 16583 7ff736134bae 16582->16583 16585 7ff736134be1 16582->16585 16584 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16583->16584 16586 7ff736134bd7 16584->16586 16588 7ff736130130 16585->16588 16586->16314 16595 7ff73613537c EnterCriticalSection 16588->16595 16603 7ff73613537c EnterCriticalSection 16596->16603 16605 7ff736122060 86 API calls 16604->16605 16606 7ff736121f97 16605->16606 16609 7ff7361354d0 16606->16609 16610 7ff7361354fb 16609->16610 16613 7ff736135394 16610->16613 16626 7ff736138498 EnterCriticalSection 16613->16626 16628 7ff73612304c GetModuleFileNameW 16627->16628 16628->16003 16628->16004 16630 7ff736128102 WideCharToMultiByte 16629->16630 16631 7ff736128094 WideCharToMultiByte 16629->16631 16632 7ff73612812f 16630->16632 16637 7ff7361230a5 16630->16637 16633 7ff7361280be 16631->16633 16636 7ff7361280d5 16631->16636 16634 7ff736122010 86 API calls 16632->16634 16635 7ff736122010 86 API calls 16633->16635 16634->16637 16635->16637 16636->16630 16638 7ff7361280eb 16636->16638 16637->16008 16637->16011 16639 7ff736122010 86 API calls 16638->16639 16639->16637 16641 7ff736126d8e 16640->16641 16642 7ff73613ab23 16640->16642 16641->16025 16642->16641 16643 7ff73613abac __std_exception_copy 37 API calls 16642->16643 16644 7ff73613ab50 16643->16644 16644->16641 16645 7ff73613b034 _wfindfirst32i64 17 API calls 16644->16645 16646 7ff73613ab80 16645->16646 16648 7ff736123150 120 API calls 16647->16648 16649 7ff736121a76 16648->16649 16650 7ff736121c24 16649->16650 16651 7ff736127460 83 API calls 16649->16651 16652 7ff73612b140 _wfindfirst32i64 8 API calls 16650->16652 16653 7ff736121aae 16651->16653 16654 7ff736121c38 16652->16654 16678 7ff736121adf 16653->16678 16686 7ff73612fc84 16653->16686 16654->16044 16680 7ff736122fc0 16654->16680 16656 7ff73612f5fc 74 API calls 16656->16650 16657 7ff736121ac8 16658 7ff736121acc 16657->16658 16659 7ff736121ae4 16657->16659 16660 7ff736121f70 86 API calls 16658->16660 16690 7ff73612f94c 16659->16690 16660->16678 16663 7ff736121b17 16665 7ff73612fc84 73 API calls 16663->16665 16664 7ff736121aff 16666 7ff736121f70 86 API calls 16664->16666 16667 7ff736121b64 16665->16667 16666->16678 16668 7ff736121b8e 16667->16668 16669 7ff736121b76 16667->16669 16671 7ff73612f94c _fread_nolock 53 API calls 16668->16671 16670 7ff736121f70 86 API calls 16669->16670 16670->16678 16672 7ff736121ba3 16671->16672 16673 7ff736121ba9 16672->16673 16674 7ff736121bbe 16672->16674 16676 7ff736121f70 86 API calls 16673->16676 16693 7ff73612f6c0 16674->16693 16676->16678 16678->16656 16679 7ff736121fb0 86 API calls 16679->16678 16681 7ff736121e90 49 API calls 16680->16681 16682 7ff736122fdd 16681->16682 16682->16045 16684 7ff736121e90 49 API calls 16683->16684 16685 7ff736123200 16684->16685 16685->16044 16687 7ff73612fcb4 16686->16687 16699 7ff73612fa14 16687->16699 16689 7ff73612fccd 16689->16657 16711 7ff73612f96c 16690->16711 16694 7ff73612f6c9 16693->16694 16698 7ff736121bd2 16693->16698 16695 7ff736137af8 memcpy_s 11 API calls 16694->16695 16696 7ff73612f6ce 16695->16696 16697 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16696->16697 16697->16698 16698->16678 16698->16679 16700 7ff73612fa7e 16699->16700 16701 7ff73612fa3e 16699->16701 16700->16701 16702 7ff73612fa8a 16700->16702 16703 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16701->16703 16710 7ff73613537c EnterCriticalSection 16702->16710 16709 7ff73612fa65 16703->16709 16709->16689 16712 7ff736121af9 16711->16712 16713 7ff73612f996 16711->16713 16712->16663 16712->16664 16713->16712 16714 7ff73612f9e2 16713->16714 16715 7ff73612f9a5 memcpy_s 16713->16715 16724 7ff73613537c EnterCriticalSection 16714->16724 16718 7ff736137af8 memcpy_s 11 API calls 16715->16718 16720 7ff73612f9ba 16718->16720 16721 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16720->16721 16721->16712 16726 7ff736126b16 16725->16726 16727 7ff736126b3a 16726->16727 16728 7ff736126b8d GetTempPathW GetCurrentProcessId 16726->16728 16730 7ff736126d10 92 API calls 16727->16730 16763 7ff736127710 16728->16763 16731 7ff736126b46 16730->16731 16787 7ff7361265d0 16731->16787 16737 7ff736126b6c __std_exception_destroy 16737->16728 16743 7ff736126b7a 16737->16743 16738 7ff73612b140 _wfindfirst32i64 8 API calls 16741 7ff73612154f 16738->16741 16739 7ff736126bbb __std_exception_destroy 16740 7ff736126c66 16739->16740 16744 7ff736126bf1 16739->16744 16767 7ff736138c18 16739->16767 16770 7ff736127c10 16739->16770 16742 7ff736128070 88 API calls 16740->16742 16741->16056 16741->16060 16748 7ff736126c77 __std_exception_destroy 16742->16748 16745 7ff736121fb0 86 API calls 16743->16745 16747 7ff736127f60 88 API calls 16744->16747 16757 7ff736126c2a __std_exception_destroy 16744->16757 16746 7ff736126b86 16745->16746 16746->16757 16749 7ff736126c07 16747->16749 16750 7ff736127f60 88 API calls 16748->16750 16748->16757 16751 7ff736126c49 SetEnvironmentVariableW 16749->16751 16752 7ff736126c0c 16749->16752 16753 7ff736126c95 16750->16753 16751->16757 16754 7ff736127f60 88 API calls 16752->16754 16755 7ff736126c9a 16753->16755 16756 7ff736126ccd SetEnvironmentVariableW 16753->16756 16758 7ff736126c1c 16754->16758 16759 7ff736127f60 88 API calls 16755->16759 16756->16757 16757->16738 16761 7ff736137f60 38 API calls 16758->16761 16760 7ff736126caa 16759->16760 16762 7ff736137f60 38 API calls 16760->16762 16761->16757 16762->16757 16764 7ff736127735 16763->16764 16821 7ff736134ec4 16764->16821 17015 7ff736138844 16767->17015 16771 7ff73612b0e0 16770->16771 16772 7ff736127c20 GetCurrentProcess OpenProcessToken 16771->16772 16773 7ff736127c6b GetTokenInformation 16772->16773 16774 7ff736127ce1 __std_exception_destroy 16772->16774 16775 7ff736127c98 16773->16775 16776 7ff736127c8d GetLastError 16773->16776 16777 7ff736127cfa 16774->16777 16778 7ff736127cf4 FindCloseChangeNotification 16774->16778 16775->16774 16779 7ff736127cae GetTokenInformation 16775->16779 16776->16774 16776->16775 17146 7ff736127860 16777->17146 16778->16777 16779->16774 16781 7ff736127cd4 ConvertSidToStringSidW 16779->16781 16781->16774 16783 7ff736127d6e 16785 7ff73612b140 _wfindfirst32i64 8 API calls 16783->16785 16784 7ff736127d56 CreateDirectoryW 16784->16783 16786 7ff736127d83 16785->16786 16786->16739 16788 7ff7361265dc 16787->16788 16789 7ff736127f60 88 API calls 16788->16789 16790 7ff7361265fe 16789->16790 16791 7ff736126619 ExpandEnvironmentStringsW 16790->16791 16792 7ff736126606 16790->16792 16794 7ff73612663f __std_exception_destroy 16791->16794 16793 7ff736121fb0 86 API calls 16792->16793 16799 7ff736126612 16793->16799 16795 7ff736126643 16794->16795 16796 7ff736126656 16794->16796 16797 7ff736121fb0 86 API calls 16795->16797 16801 7ff736126670 16796->16801 16802 7ff736126664 16796->16802 16797->16799 16798 7ff73612b140 _wfindfirst32i64 8 API calls 16800 7ff736126738 16798->16800 16799->16798 16800->16757 16811 7ff736137f60 16800->16811 17157 7ff736136428 16801->17157 17150 7ff736137b18 16802->17150 16805 7ff73612666e 16806 7ff73612668a 16805->16806 16809 7ff73612669d memcpy_s 16805->16809 16807 7ff736121fb0 86 API calls 16806->16807 16807->16799 16808 7ff736126712 CreateDirectoryW 16808->16799 16809->16808 16810 7ff7361266ec CreateDirectoryW 16809->16810 16810->16809 16812 7ff736137f6d 16811->16812 16813 7ff736137f80 16811->16813 16815 7ff736137af8 memcpy_s 11 API calls 16812->16815 17251 7ff736137be4 16813->17251 16816 7ff736137f72 16815->16816 16817 7ff73613b014 _invalid_parameter_noinfo 37 API calls 16816->16817 16819 7ff736137f7e 16817->16819 16819->16737 16822 7ff736134f1e 16821->16822 16823 7ff736134f43 16822->16823 16825 7ff736134f7f 16822->16825 16824 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16823->16824 16827 7ff736134f6d 16824->16827 16839 7ff736132a34 16825->16839 16829 7ff73612b140 _wfindfirst32i64 8 API calls 16827->16829 16828 7ff736135060 16830 7ff73613b07c __free_lconv_mon 11 API calls 16828->16830 16832 7ff736127754 16829->16832 16830->16827 16832->16739 16833 7ff736135035 16836 7ff73613b07c __free_lconv_mon 11 API calls 16833->16836 16834 7ff736135086 16834->16828 16835 7ff736135090 16834->16835 16838 7ff73613b07c __free_lconv_mon 11 API calls 16835->16838 16836->16827 16837 7ff73613502c 16837->16828 16837->16833 16838->16827 16840 7ff736132a72 16839->16840 16841 7ff736132a62 16839->16841 16842 7ff736132a7b 16840->16842 16847 7ff736132aa9 16840->16847 16843 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16841->16843 16844 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16842->16844 16845 7ff736132aa1 16843->16845 16844->16845 16845->16828 16845->16833 16845->16834 16845->16837 16847->16841 16847->16845 16850 7ff736133a08 16847->16850 16883 7ff73613301c 16847->16883 16920 7ff73613228c 16847->16920 16851 7ff736133a4a 16850->16851 16852 7ff736133abb 16850->16852 16853 7ff736133a50 16851->16853 16854 7ff736133ae5 16851->16854 16855 7ff736133ac0 16852->16855 16856 7ff736133b14 16852->16856 16857 7ff736133a55 16853->16857 16858 7ff736133a84 16853->16858 16939 7ff736131344 16854->16939 16859 7ff736133ac2 16855->16859 16860 7ff736133af5 16855->16860 16862 7ff736133b2b 16856->16862 16865 7ff736133b1e 16856->16865 16866 7ff736133b23 16856->16866 16857->16862 16863 7ff736133a5b 16857->16863 16858->16863 16858->16866 16864 7ff736133a64 16859->16864 16872 7ff736133ad1 16859->16872 16946 7ff736130f34 16860->16946 16953 7ff736134710 16862->16953 16863->16864 16870 7ff736133a96 16863->16870 16878 7ff736133a7f 16863->16878 16881 7ff736133b54 16864->16881 16923 7ff7361341bc 16864->16923 16865->16854 16865->16866 16866->16881 16957 7ff736131754 16866->16957 16870->16881 16933 7ff7361344f8 16870->16933 16872->16854 16873 7ff736133ad6 16872->16873 16876 7ff7361345bc 37 API calls 16873->16876 16873->16881 16875 7ff73612b140 _wfindfirst32i64 8 API calls 16877 7ff736133e4e 16875->16877 16876->16878 16877->16847 16879 7ff736134820 45 API calls 16878->16879 16878->16881 16882 7ff736133d40 16878->16882 16879->16882 16881->16875 16882->16881 16964 7ff73613f138 16882->16964 16884 7ff73613302a 16883->16884 16885 7ff736133040 16883->16885 16886 7ff736133a4a 16884->16886 16887 7ff736133abb 16884->16887 16907 7ff736133080 16884->16907 16888 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16885->16888 16885->16907 16889 7ff736133a50 16886->16889 16890 7ff736133ae5 16886->16890 16891 7ff736133ac0 16887->16891 16892 7ff736133b14 16887->16892 16888->16907 16893 7ff736133a55 16889->16893 16894 7ff736133a84 16889->16894 16897 7ff736131344 38 API calls 16890->16897 16895 7ff736133ac2 16891->16895 16896 7ff736133af5 16891->16896 16898 7ff736133b2b 16892->16898 16901 7ff736133b1e 16892->16901 16904 7ff736133b23 16892->16904 16893->16898 16899 7ff736133a5b 16893->16899 16894->16899 16894->16904 16900 7ff736133a64 16895->16900 16909 7ff736133ad1 16895->16909 16902 7ff736130f34 38 API calls 16896->16902 16915 7ff736133a7f 16897->16915 16905 7ff736134710 45 API calls 16898->16905 16899->16900 16906 7ff736133a96 16899->16906 16899->16915 16903 7ff7361341bc 47 API calls 16900->16903 16918 7ff736133b54 16900->16918 16901->16890 16901->16904 16902->16915 16903->16915 16908 7ff736131754 38 API calls 16904->16908 16904->16918 16905->16915 16911 7ff7361344f8 46 API calls 16906->16911 16906->16918 16907->16847 16908->16915 16909->16890 16910 7ff736133ad6 16909->16910 16913 7ff7361345bc 37 API calls 16910->16913 16910->16918 16911->16915 16912 7ff73612b140 _wfindfirst32i64 8 API calls 16914 7ff736133e4e 16912->16914 16913->16915 16914->16847 16916 7ff736134820 45 API calls 16915->16916 16915->16918 16919 7ff736133d40 16915->16919 16916->16919 16917 7ff73613f138 46 API calls 16917->16919 16918->16912 16919->16917 16919->16918 16998 7ff7361305b8 16920->16998 16924 7ff7361341e2 16923->16924 16925 7ff736130170 12 API calls 16924->16925 16926 7ff736134232 16925->16926 16927 7ff73613eca0 46 API calls 16926->16927 16928 7ff736134305 16927->16928 16929 7ff736134327 16928->16929 16930 7ff736134820 45 API calls 16928->16930 16931 7ff736134820 45 API calls 16929->16931 16932 7ff7361343b5 16929->16932 16930->16929 16931->16932 16932->16878 16936 7ff73613452d 16933->16936 16934 7ff736134572 16934->16878 16935 7ff73613454b 16938 7ff73613f138 46 API calls 16935->16938 16936->16934 16936->16935 16937 7ff736134820 45 API calls 16936->16937 16937->16935 16938->16934 16940 7ff736131377 16939->16940 16941 7ff7361313a6 16940->16941 16943 7ff736131463 16940->16943 16945 7ff7361313e3 16941->16945 16976 7ff736130218 16941->16976 16944 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16943->16944 16944->16945 16945->16878 16947 7ff736130f67 16946->16947 16948 7ff736130f96 16947->16948 16950 7ff736131053 16947->16950 16949 7ff736130218 12 API calls 16948->16949 16952 7ff736130fd3 16948->16952 16949->16952 16951 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16950->16951 16951->16952 16952->16878 16954 7ff736134753 16953->16954 16956 7ff736134757 __crtLCMapStringW 16954->16956 16984 7ff7361347ac 16954->16984 16956->16878 16958 7ff736131787 16957->16958 16959 7ff7361317b6 16958->16959 16961 7ff736131873 16958->16961 16960 7ff736130218 12 API calls 16959->16960 16963 7ff7361317f3 16959->16963 16960->16963 16962 7ff73613af48 _invalid_parameter_noinfo 37 API calls 16961->16962 16962->16963 16963->16878 16966 7ff73613f169 16964->16966 16974 7ff73613f177 16964->16974 16965 7ff73613f197 16968 7ff73613f1a8 16965->16968 16969 7ff73613f1cf 16965->16969 16966->16965 16967 7ff736134820 45 API calls 16966->16967 16966->16974 16967->16965 16988 7ff736140b20 16968->16988 16971 7ff73613f25a 16969->16971 16972 7ff73613f1f9 16969->16972 16969->16974 16973 7ff73613fca0 _fread_nolock MultiByteToWideChar 16971->16973 16972->16974 16991 7ff73613fca0 16972->16991 16973->16974 16974->16882 16977 7ff73613024f 16976->16977 16983 7ff73613023e 16976->16983 16978 7ff73613dd2c _fread_nolock 12 API calls 16977->16978 16977->16983 16979 7ff736130280 16978->16979 16980 7ff736130294 16979->16980 16981 7ff73613b07c __free_lconv_mon 11 API calls 16979->16981 16982 7ff73613b07c __free_lconv_mon 11 API calls 16980->16982 16981->16980 16982->16983 16983->16945 16985 7ff7361347ca 16984->16985 16986 7ff7361347d2 16984->16986 16987 7ff736134820 45 API calls 16985->16987 16986->16956 16987->16986 16994 7ff736147780 16988->16994 16993 7ff73613fca9 MultiByteToWideChar 16991->16993 16997 7ff7361477e4 16994->16997 16995 7ff73612b140 _wfindfirst32i64 8 API calls 16996 7ff736140b3d 16995->16996 16996->16974 16997->16995 16999 7ff7361305ed 16998->16999 17000 7ff7361305ff 16998->17000 17001 7ff736137af8 memcpy_s 11 API calls 16999->17001 17002 7ff73613060d 17000->17002 17007 7ff736130649 17000->17007 17003 7ff7361305f2 17001->17003 17004 7ff73613af48 _invalid_parameter_noinfo 37 API calls 17002->17004 17005 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17003->17005 17013 7ff7361305fd 17004->17013 17005->17013 17006 7ff7361309c5 17008 7ff736137af8 memcpy_s 11 API calls 17006->17008 17006->17013 17007->17006 17009 7ff736137af8 memcpy_s 11 API calls 17007->17009 17010 7ff736130c59 17008->17010 17011 7ff7361309ba 17009->17011 17014 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17010->17014 17012 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17011->17012 17012->17006 17013->16847 17014->17013 17056 7ff736141c68 17015->17056 17115 7ff7361419e0 17056->17115 17136 7ff736140d58 EnterCriticalSection 17115->17136 17147 7ff736127885 17146->17147 17148 7ff736134ec4 48 API calls 17147->17148 17149 7ff7361278a8 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 17148->17149 17149->16783 17149->16784 17151 7ff736137b36 17150->17151 17154 7ff736137b69 17150->17154 17152 7ff736140ef4 _wfindfirst32i64 37 API calls 17151->17152 17151->17154 17153 7ff736137b65 17152->17153 17153->17154 17155 7ff73613b034 _wfindfirst32i64 17 API calls 17153->17155 17154->16805 17156 7ff736137b99 17155->17156 17158 7ff7361364b2 17157->17158 17159 7ff736136444 17157->17159 17194 7ff736140540 17158->17194 17159->17158 17161 7ff736136449 17159->17161 17162 7ff73613647e 17161->17162 17163 7ff736136461 17161->17163 17177 7ff73613626c GetFullPathNameW 17162->17177 17169 7ff7361361f8 GetFullPathNameW 17163->17169 17168 7ff736136476 __std_exception_destroy 17168->16805 17170 7ff73613621e GetLastError 17169->17170 17171 7ff736136234 17169->17171 17172 7ff736137a6c _fread_nolock 11 API calls 17170->17172 17174 7ff736137af8 memcpy_s 11 API calls 17171->17174 17176 7ff736136230 17171->17176 17173 7ff73613622b 17172->17173 17175 7ff736137af8 memcpy_s 11 API calls 17173->17175 17174->17176 17175->17176 17176->17168 17178 7ff73613629f GetLastError 17177->17178 17183 7ff7361362b5 __std_exception_destroy 17177->17183 17179 7ff736137a6c _fread_nolock 11 API calls 17178->17179 17180 7ff7361362ac 17179->17180 17181 7ff736137af8 memcpy_s 11 API calls 17180->17181 17182 7ff7361362b1 17181->17182 17185 7ff736136344 17182->17185 17183->17182 17184 7ff73613630f GetFullPathNameW 17183->17184 17184->17178 17184->17182 17186 7ff73613636d memcpy_s 17185->17186 17190 7ff7361363b8 memcpy_s 17185->17190 17187 7ff7361363a1 17186->17187 17186->17190 17192 7ff7361363da 17186->17192 17188 7ff736137af8 memcpy_s 11 API calls 17187->17188 17189 7ff7361363a6 17188->17189 17191 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17189->17191 17190->17168 17191->17190 17192->17190 17193 7ff736137af8 memcpy_s 11 API calls 17192->17193 17193->17189 17197 7ff736140350 17194->17197 17198 7ff73614037b 17197->17198 17199 7ff736140392 17197->17199 17200 7ff736137af8 memcpy_s 11 API calls 17198->17200 17201 7ff7361403b7 17199->17201 17202 7ff736140396 17199->17202 17215 7ff736140380 17200->17215 17235 7ff73613f9b8 17201->17235 17223 7ff7361404bc 17202->17223 17205 7ff7361403bc 17210 7ff736140461 17205->17210 17216 7ff7361403e3 17205->17216 17207 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17222 7ff73614038b __std_exception_destroy 17207->17222 17208 7ff73614039f 17209 7ff736137ad8 _fread_nolock 11 API calls 17208->17209 17211 7ff7361403a4 17209->17211 17210->17198 17212 7ff736140469 17210->17212 17214 7ff736137af8 memcpy_s 11 API calls 17211->17214 17217 7ff7361361f8 13 API calls 17212->17217 17213 7ff73612b140 _wfindfirst32i64 8 API calls 17218 7ff7361404b1 17213->17218 17214->17215 17215->17207 17219 7ff73613626c 14 API calls 17216->17219 17217->17222 17218->17168 17220 7ff736140427 17219->17220 17221 7ff736136344 37 API calls 17220->17221 17220->17222 17221->17222 17222->17213 17224 7ff736140506 17223->17224 17225 7ff7361404d6 17223->17225 17226 7ff7361404f1 17224->17226 17227 7ff736140511 GetDriveTypeW 17224->17227 17228 7ff736137ad8 _fread_nolock 11 API calls 17225->17228 17230 7ff73612b140 _wfindfirst32i64 8 API calls 17226->17230 17227->17226 17229 7ff7361404db 17228->17229 17231 7ff736137af8 memcpy_s 11 API calls 17229->17231 17232 7ff73614039b 17230->17232 17233 7ff7361404e6 17231->17233 17232->17205 17232->17208 17234 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17233->17234 17234->17226 17249 7ff73612c860 17235->17249 17237 7ff73613f9ee GetCurrentDirectoryW 17238 7ff73613fa2c 17237->17238 17239 7ff73613fa05 17237->17239 17240 7ff73613f2e0 memcpy_s 11 API calls 17238->17240 17241 7ff73612b140 _wfindfirst32i64 8 API calls 17239->17241 17242 7ff73613fa3b 17240->17242 17245 7ff73613fa99 17241->17245 17243 7ff73613fa45 GetCurrentDirectoryW 17242->17243 17244 7ff73613fa54 17242->17244 17243->17244 17246 7ff73613fa59 17243->17246 17247 7ff736137af8 memcpy_s 11 API calls 17244->17247 17245->17205 17248 7ff73613b07c __free_lconv_mon 11 API calls 17246->17248 17247->17246 17248->17239 17250 7ff73612c840 17249->17250 17250->17237 17250->17250 17258 7ff736140d58 EnterCriticalSection 17251->17258 17260 7ff73612173e 17259->17260 17261 7ff736121726 17259->17261 17263 7ff736121768 17260->17263 17264 7ff736121744 17260->17264 17262 7ff736121fb0 86 API calls 17261->17262 17265 7ff736121732 17262->17265 17350 7ff736126dc0 17263->17350 17389 7ff7361212b0 17264->17389 17265->16084 17270 7ff7361217b9 17274 7ff736123150 120 API calls 17270->17274 17271 7ff73612178d 17273 7ff736121f70 86 API calls 17271->17273 17272 7ff73612175f 17272->16084 17276 7ff7361217a3 17273->17276 17277 7ff7361217ce 17274->17277 17275 7ff736121fb0 86 API calls 17275->17272 17276->16084 17278 7ff7361217ee 17277->17278 17279 7ff7361217d6 17277->17279 17281 7ff73612fc84 73 API calls 17278->17281 17280 7ff736121fb0 86 API calls 17279->17280 17282 7ff7361217e5 17280->17282 17283 7ff7361217ff 17281->17283 17286 7ff73612f5fc 74 API calls 17282->17286 17284 7ff736121823 17283->17284 17285 7ff736121803 17283->17285 17287 7ff736121829 17284->17287 17291 7ff736121841 17284->17291 17288 7ff736121f70 86 API calls 17285->17288 17289 7ff736121937 17286->17289 17369 7ff736121050 17287->17369 17295 7ff736121819 __std_exception_destroy 17288->17295 17289->16084 17292 7ff736121863 17291->17292 17299 7ff736121882 17291->17299 17294 7ff736121f70 86 API calls 17292->17294 17293 7ff73612f5fc 74 API calls 17293->17282 17294->17295 17295->17293 17296 7ff73612f94c _fread_nolock 53 API calls 17296->17299 17297 7ff7361218e5 17300 7ff736121f70 86 API calls 17297->17300 17299->17295 17299->17296 17299->17297 17428 7ff73613008c 17299->17428 17300->17295 17302 7ff736122146 17301->17302 17303 7ff736121e90 49 API calls 17302->17303 17304 7ff736122179 17303->17304 17305 7ff736122fc0 49 API calls 17304->17305 17335 7ff7361224aa 17304->17335 17306 7ff7361221e7 17305->17306 17307 7ff736122fc0 49 API calls 17306->17307 17308 7ff7361221f8 17307->17308 17309 7ff736122219 17308->17309 17310 7ff736122255 17308->17310 17515 7ff736122580 17309->17515 17312 7ff736122580 75 API calls 17310->17312 17313 7ff736122253 17312->17313 17314 7ff736122294 17313->17314 17315 7ff7361222d6 17313->17315 17523 7ff736126750 17314->17523 17317 7ff736122580 75 API calls 17315->17317 17319 7ff736122300 17317->17319 17320 7ff73612239c 17319->17320 17323 7ff736122580 75 API calls 17319->17323 17326 7ff736121e50 86 API calls 17320->17326 17343 7ff7361224af 17320->17343 17321 7ff7361222b7 17322 7ff736122544 17329 7ff736121fb0 86 API calls 17322->17329 17325 7ff736122332 17323->17325 17325->17320 17330 7ff736122580 75 API calls 17325->17330 17328 7ff7361223ef 17326->17328 17327 7ff7361222d1 17331 7ff73612b140 _wfindfirst32i64 8 API calls 17327->17331 17333 7ff736121e90 49 API calls 17328->17333 17328->17335 17329->17335 17332 7ff736122360 17330->17332 17334 7ff736122391 17331->17334 17332->17320 17336 7ff736122364 17332->17336 17337 7ff736122417 17333->17337 17334->16084 17338 7ff736121fb0 86 API calls 17336->17338 17337->17322 17340 7ff736121e90 49 API calls 17337->17340 17338->17327 17339 7ff736121fb0 86 API calls 17339->17343 17341 7ff736122444 17340->17341 17341->17322 17342 7ff736121e90 49 API calls 17341->17342 17345 7ff736122471 17342->17345 17343->17322 17343->17339 17344 7ff736121710 140 API calls 17343->17344 17344->17343 17345->17322 17346 7ff736121a40 121 API calls 17345->17346 17351 7ff736126dd0 17350->17351 17352 7ff736121e90 49 API calls 17351->17352 17353 7ff736126e11 17352->17353 17367 7ff736126e91 17353->17367 17432 7ff7361230e0 17353->17432 17355 7ff73612b140 _wfindfirst32i64 8 API calls 17357 7ff736121785 17355->17357 17357->17270 17357->17271 17358 7ff736126ecb 17438 7ff736126970 17358->17438 17360 7ff736126e80 17363 7ff736121fb0 86 API calls 17360->17363 17361 7ff736126d10 92 API calls 17368 7ff736126e42 __std_exception_destroy 17361->17368 17363->17367 17364 7ff736121fb0 86 API calls 17364->17358 17365 7ff736123150 120 API calls 17365->17367 17366 7ff736126eb4 17366->17364 17367->17355 17368->17360 17368->17366 17370 7ff7361210a6 17369->17370 17371 7ff7361210ad 17370->17371 17372 7ff7361210d3 17370->17372 17373 7ff736121fb0 86 API calls 17371->17373 17375 7ff736121109 17372->17375 17376 7ff7361210ed 17372->17376 17374 7ff7361210c0 17373->17374 17374->17295 17378 7ff73612111b 17375->17378 17387 7ff736121137 memcpy_s 17375->17387 17377 7ff736121f70 86 API calls 17376->17377 17390 7ff7361212c2 17389->17390 17391 7ff736123150 120 API calls 17390->17391 17392 7ff7361212f2 17391->17392 17393 7ff7361212fa 17392->17393 17394 7ff736121311 17392->17394 17395 7ff736121fb0 86 API calls 17393->17395 17396 7ff73612fc84 73 API calls 17394->17396 17424 7ff73612130a __std_exception_destroy 17395->17424 17397 7ff736121323 17396->17397 17398 7ff736121327 17397->17398 17400 7ff73612134d 17397->17400 17399 7ff736121f70 86 API calls 17398->17399 17401 7ff73612133e 17399->17401 17404 7ff736121368 17400->17404 17405 7ff736121390 17400->17405 17403 7ff73612f5fc 74 API calls 17401->17403 17402 7ff73612b140 _wfindfirst32i64 8 API calls 17407 7ff736121454 17402->17407 17403->17424 17408 7ff736121f70 86 API calls 17404->17408 17406 7ff7361213aa 17405->17406 17419 7ff736121463 17405->17419 17410 7ff736121050 94 API calls 17406->17410 17407->17272 17407->17275 17409 7ff736121383 17408->17409 17412 7ff73612f5fc 74 API calls 17409->17412 17413 7ff7361213bb 17410->17413 17411 7ff7361213c3 17414 7ff73612f5fc 74 API calls 17411->17414 17412->17424 17413->17411 17415 7ff7361214d2 __std_exception_destroy 17413->17415 17416 7ff7361213cf 17414->17416 17423 7ff73612f5fc 74 API calls 17415->17423 17418 7ff736126970 102 API calls 17416->17418 17417 7ff73612f94c _fread_nolock 53 API calls 17417->17419 17420 7ff7361213de 17418->17420 17419->17411 17419->17417 17421 7ff7361214bb 17419->17421 17420->17424 17425 7ff736121e90 49 API calls 17420->17425 17422 7ff736121f70 86 API calls 17421->17422 17422->17415 17423->17424 17424->17402 17426 7ff73612140c 17425->17426 17426->17424 17486 7ff7361232f0 17426->17486 17429 7ff7361300bc 17428->17429 17500 7ff73612fddc 17429->17500 17431 7ff7361300da 17431->17299 17433 7ff7361230ea 17432->17433 17434 7ff736127f60 88 API calls 17433->17434 17435 7ff736123112 17434->17435 17436 7ff73612b140 _wfindfirst32i64 8 API calls 17435->17436 17437 7ff73612313a 17436->17437 17437->17358 17437->17361 17437->17368 17439 7ff736126980 17438->17439 17440 7ff736121e90 49 API calls 17439->17440 17441 7ff7361269b1 17440->17441 17442 7ff736126ac9 17441->17442 17443 7ff736121e90 49 API calls 17441->17443 17444 7ff73612b140 _wfindfirst32i64 8 API calls 17442->17444 17446 7ff7361269d8 17443->17446 17445 7ff736126ade 17444->17445 17445->17365 17445->17367 17446->17442 17452 7ff7361361c8 17446->17452 17453 7ff73613b880 __CxxCallCatchBlock 45 API calls 17452->17453 17454 7ff7361361dd 17453->17454 17455 7ff736140347 17454->17455 17458 7ff736140266 17454->17458 17487 7ff736123300 17486->17487 17488 7ff736127f60 88 API calls 17487->17488 17489 7ff73612332e 17488->17489 17501 7ff73612fdfc 17500->17501 17502 7ff73612fe29 17500->17502 17501->17502 17503 7ff73612fe31 17501->17503 17504 7ff73612fe06 17501->17504 17502->17431 17516 7ff7361225b4 17515->17516 17517 7ff736134c70 49 API calls 17516->17517 17518 7ff7361225da 17517->17518 17519 7ff7361225eb 17518->17519 17560 7ff736135e60 17518->17560 17521 7ff73612b140 _wfindfirst32i64 8 API calls 17519->17521 17522 7ff736122609 17521->17522 17522->17313 17524 7ff73612675e 17523->17524 17525 7ff736123150 120 API calls 17524->17525 17526 7ff73612678d 17525->17526 17527 7ff736121e90 49 API calls 17526->17527 17528 7ff7361267b6 17527->17528 17529 7ff7361267bd 17528->17529 17530 7ff7361230e0 88 API calls 17528->17530 17531 7ff736126939 17529->17531 17533 7ff736126899 17529->17533 17532 7ff7361267d0 17530->17532 17536 7ff73612f5fc 74 API calls 17531->17536 17553 7ff736126935 17531->17553 17534 7ff736126854 17532->17534 17542 7ff736126d10 92 API calls 17532->17542 17547 7ff7361267ee __std_exception_destroy 17532->17547 17741 7ff73612f694 17533->17741 17537 7ff736126970 102 API calls 17534->17537 17536->17553 17543 7ff73612685f 17537->17543 17538 7ff736126827 17544 7ff736121fb0 86 API calls 17538->17544 17539 7ff73612683d 17546 7ff736121fb0 86 API calls 17539->17546 17540 7ff73612689e 17550 7ff73612f94c _fread_nolock 53 API calls 17540->17550 17554 7ff73612f6c0 37 API calls 17540->17554 17555 7ff73613008c 76 API calls 17540->17555 17556 7ff7361268dc 17540->17556 17557 7ff73612f694 37 API calls 17540->17557 17559 7ff736126916 17540->17559 17541 7ff73612b140 _wfindfirst32i64 8 API calls 17545 7ff7361222ae 17541->17545 17542->17547 17543->17529 17549 7ff736123150 120 API calls 17543->17549 17544->17529 17545->17321 17545->17322 17546->17534 17547->17538 17547->17539 17549->17529 17550->17540 17553->17541 17554->17540 17555->17540 17557->17540 17561 7ff736135e89 17560->17561 17562 7ff736135e7d 17560->17562 17602 7ff736135a74 17561->17602 17577 7ff7361356d8 17562->17577 17566 7ff736135e82 17566->17519 17569 7ff736135ec1 17613 7ff73613555c 17569->17613 17571 7ff736135f1d 17571->17566 17574 7ff73613b07c __free_lconv_mon 11 API calls 17571->17574 17572 7ff736135f31 17573 7ff7361356d8 69 API calls 17572->17573 17575 7ff736135f3d 17573->17575 17574->17566 17575->17566 17578 7ff7361356f2 17577->17578 17579 7ff73613570f 17577->17579 17580 7ff736137ad8 _fread_nolock 11 API calls 17578->17580 17579->17578 17581 7ff736135722 CreateFileW 17579->17581 17582 7ff7361356f7 17580->17582 17583 7ff73613578c 17581->17583 17584 7ff736135756 17581->17584 17585 7ff736137af8 memcpy_s 11 API calls 17582->17585 17661 7ff736135d50 17583->17661 17635 7ff73613582c GetFileType 17584->17635 17588 7ff7361356ff 17585->17588 17593 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17588->17593 17598 7ff73613570a 17593->17598 17598->17566 17603 7ff736135a98 17602->17603 17609 7ff736135a93 17602->17609 17604 7ff73613b880 __CxxCallCatchBlock 45 API calls 17603->17604 17603->17609 17605 7ff736135ab3 17604->17605 17723 7ff73613e0b4 17605->17723 17609->17569 17610 7ff73613f56c 17609->17610 17731 7ff73613f358 17610->17731 17614 7ff7361355aa 17613->17614 17615 7ff736135586 17613->17615 17616 7ff7361355af 17614->17616 17617 7ff736135604 17614->17617 17619 7ff73613b07c __free_lconv_mon 11 API calls 17615->17619 17621 7ff736135595 17615->17621 17620 7ff7361355c4 17616->17620 17616->17621 17622 7ff73613b07c __free_lconv_mon 11 API calls 17616->17622 17618 7ff73613fca0 _fread_nolock MultiByteToWideChar 17617->17618 17629 7ff736135620 17618->17629 17619->17621 17623 7ff73613dd2c _fread_nolock 12 API calls 17620->17623 17621->17571 17621->17572 17622->17620 17623->17621 17624 7ff736135627 GetLastError 17625 7ff736135662 17625->17621 17628 7ff736135655 17629->17624 17629->17625 17629->17628 17632 7ff73613b07c __free_lconv_mon 11 API calls 17629->17632 17632->17628 17636 7ff736135937 17635->17636 17638 7ff73613587a 17635->17638 17639 7ff736135961 17636->17639 17640 7ff73613593f 17636->17640 17637 7ff7361358a6 GetFileInformationByHandle 17644 7ff736135952 GetLastError 17637->17644 17645 7ff7361358cf 17637->17645 17638->17637 17643 7ff736135c4c 21 API calls 17638->17643 17641 7ff736135922 17639->17641 17642 7ff736135984 PeekNamedPipe 17639->17642 17640->17644 17646 7ff736135943 17640->17646 17642->17641 17650 7ff736135894 17643->17650 17650->17637 17650->17641 17662 7ff736135d86 17661->17662 17663 7ff736137af8 memcpy_s 11 API calls 17662->17663 17681 7ff736135e1e __std_exception_destroy 17662->17681 17665 7ff736135d98 17663->17665 17664 7ff73612b140 _wfindfirst32i64 8 API calls 17666 7ff736135791 17664->17666 17667 7ff736137af8 memcpy_s 11 API calls 17665->17667 17681->17664 17724 7ff73613e0c9 17723->17724 17726 7ff736135ad6 17723->17726 17725 7ff736143a14 45 API calls 17724->17725 17724->17726 17725->17726 17727 7ff73613e120 17726->17727 17728 7ff73613e148 17727->17728 17729 7ff73613e135 17727->17729 17728->17609 17729->17728 17730 7ff736142d60 45 API calls 17729->17730 17730->17728 17732 7ff73613f3b5 17731->17732 17739 7ff73613f3b0 __vcrt_FlsAlloc 17731->17739 17732->17569 17733 7ff73613f3e5 LoadLibraryW 17735 7ff73613f4ba 17733->17735 17736 7ff73613f40a GetLastError 17733->17736 17734 7ff73613f4da GetProcAddress 17734->17732 17738 7ff73613f4eb 17734->17738 17735->17734 17737 7ff73613f4d1 FreeLibrary 17735->17737 17736->17739 17737->17734 17738->17732 17739->17732 17739->17733 17739->17734 17740 7ff73613f444 LoadLibraryExW 17739->17740 17740->17735 17740->17739 17742 7ff73612f69d 17741->17742 17746 7ff73612f6ad 17741->17746 17743 7ff736137af8 memcpy_s 11 API calls 17742->17743 17744 7ff73612f6a2 17743->17744 17746->17540 17768 7ff73613ab8d 17767->17768 17769 7ff7361272da 17767->17769 17770 7ff736137af8 memcpy_s 11 API calls 17768->17770 17773 7ff7361387a4 17769->17773 17771 7ff73613ab92 17770->17771 17772 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17771->17772 17772->17769 17774 7ff7361387ad 17773->17774 17775 7ff7361387c2 17773->17775 17776 7ff736137ad8 _fread_nolock 11 API calls 17774->17776 17778 7ff736137ad8 _fread_nolock 11 API calls 17775->17778 17782 7ff7361387ba 17775->17782 17826 7ff7361364dc 17823->17826 17824 7ff736136502 17825 7ff736137af8 memcpy_s 11 API calls 17824->17825 17828 7ff736136507 17825->17828 17826->17824 17827 7ff736136535 17826->17827 17829 7ff736136548 17827->17829 17830 7ff73613653b 17827->17830 17831 7ff73613b014 _invalid_parameter_noinfo 37 API calls 17828->17831 17842 7ff73613b35c 17829->17842 17832 7ff736137af8 memcpy_s 11 API calls 17830->17832 17834 7ff7361231a9 17831->17834 17832->17834 17834->16151 17855 7ff736140d58 EnterCriticalSection 17842->17855 18203 7ff736139214 18202->18203 18206 7ff736138cf0 18203->18206 18205 7ff73613922d 18205->16161 18207 7ff736138d3a 18206->18207 18208 7ff736138d0b 18206->18208 18216 7ff73613537c EnterCriticalSection 18207->18216 18209 7ff73613af48 _invalid_parameter_noinfo 37 API calls 18208->18209 18211 7ff736138d2b 18209->18211 18211->18205 18218 7ff73612f421 18217->18218 18219 7ff73612f3f3 18217->18219 18226 7ff73612f413 18218->18226 18227 7ff73613537c EnterCriticalSection 18218->18227 18220 7ff73613af48 _invalid_parameter_noinfo 37 API calls 18219->18220 18220->18226 18226->16165 18229 7ff736123150 120 API calls 18228->18229 18230 7ff7361215c7 18229->18230 18231 7ff7361215f0 18230->18231 18232 7ff7361215cf 18230->18232 18233 7ff73612fc84 73 API calls 18231->18233 18234 7ff736121fb0 86 API calls 18232->18234 18235 7ff736121601 18233->18235 18236 7ff7361215df 18234->18236 18237 7ff736121621 18235->18237 18238 7ff736121605 18235->18238 18236->16175 18240 7ff736121651 18237->18240 18241 7ff736121631 18237->18241 18239 7ff736121f70 86 API calls 18238->18239 18250 7ff73612161c __std_exception_destroy 18239->18250 18243 7ff736121666 18240->18243 18248 7ff73612167d 18240->18248 18242 7ff736121f70 86 API calls 18241->18242 18242->18250 18245 7ff736121050 94 API calls 18243->18245 18244 7ff73612f5fc 74 API calls 18246 7ff7361216f7 18244->18246 18245->18250 18246->16175 18247 7ff73612f94c _fread_nolock 53 API calls 18247->18248 18248->18247 18249 7ff7361216be 18248->18249 18248->18250 18251 7ff736121f70 86 API calls 18249->18251 18250->18244 18251->18250 18253 7ff736127f60 88 API calls 18252->18253 18254 7ff736127427 LoadLibraryExW 18253->18254 18255 7ff736127444 __std_exception_destroy 18254->18255 18255->16201 18257 7ff7361260c9 18256->18257 18258 7ff7361260ec GetProcAddress 18256->18258 18260 7ff736122010 86 API calls 18257->18260 18258->18257 18259 7ff736126111 GetProcAddress 18258->18259 18259->18257 18261 7ff736126136 GetProcAddress 18259->18261 18262 7ff7361260dc 18260->18262 18261->18257 18263 7ff73612615e GetProcAddress 18261->18263 18262->16207 18263->18257 18264 7ff736126186 GetProcAddress 18263->18264 18264->18257 18265 7ff7361261ae GetProcAddress 18264->18265 18266 7ff7361261ca 18265->18266 18267 7ff7361261d6 GetProcAddress 18265->18267 18266->18267 18268 7ff7361261fe GetProcAddress 18267->18268 18269 7ff7361261f2 18267->18269 18269->18268 18316 7ff736124d80 18315->18316 18317 7ff736121e90 49 API calls 18316->18317 18318 7ff736124db2 18317->18318 18319 7ff736124ddb 18318->18319 18320 7ff736124dbb 18318->18320 18322 7ff736124e32 18319->18322 18323 7ff7361231d0 49 API calls 18319->18323 18321 7ff736121fb0 86 API calls 18320->18321 18326 7ff736124dd1 18321->18326 18324 7ff7361231d0 49 API calls 18322->18324 18327 7ff736124dfc 18323->18327 18325 7ff736124e4b 18324->18325 18328 7ff736124e69 18325->18328 18331 7ff736121fb0 86 API calls 18325->18331 18330 7ff73612b140 _wfindfirst32i64 8 API calls 18326->18330 18329 7ff736124e1a 18327->18329 18333 7ff736121fb0 86 API calls 18327->18333 18332 7ff736127410 89 API calls 18328->18332 18334 7ff7361230e0 88 API calls 18329->18334 18335 7ff73612262e 18330->18335 18331->18328 18336 7ff736124e76 18332->18336 18333->18329 18337 7ff736124e24 18334->18337 18335->16222 18343 7ff736124ed0 18335->18343 18338 7ff736124e7b 18336->18338 18339 7ff736124e9d 18336->18339 18337->18322 18342 7ff736127410 89 API calls 18337->18342 18340 7ff736122010 86 API calls 18338->18340 18399 7ff736124360 GetProcAddress 18339->18399 18340->18326 18342->18322 18483 7ff736123f60 18343->18483 18345 7ff736124ef4 18346 7ff736124efc 18345->18346 18347 7ff736124f0d 18345->18347 18349 7ff736121fb0 86 API calls 18346->18349 18490 7ff7361236b0 18347->18490 18354 7ff736124f08 18349->18354 18351 7ff736124f2a 18355 7ff736124f48 18351->18355 18356 7ff736124f37 18351->18356 18352 7ff736124f19 18353 7ff736121fb0 86 API calls 18352->18353 18353->18354 18354->16224 18494 7ff7361239f0 18355->18494 18357 7ff736121fb0 86 API calls 18356->18357 18357->18354 18385 7ff736124ae7 18384->18385 18385->18385 18386 7ff736124b10 18385->18386 18389 7ff736124b27 __std_exception_destroy 18385->18389 18387 7ff736121fb0 86 API calls 18386->18387 18388 7ff736124b1c 18387->18388 18388->16226 18390 7ff7361215a0 120 API calls 18389->18390 18391 7ff736121fb0 86 API calls 18389->18391 18392 7ff736124c17 18389->18392 18390->18389 18391->18389 18392->16226 18400 7ff7361243a0 GetProcAddress 18399->18400 18401 7ff736124382 18399->18401 18400->18401 18402 7ff7361243c5 GetProcAddress 18400->18402 18404 7ff736122010 86 API calls 18401->18404 18402->18401 18403 7ff7361243ea GetProcAddress 18402->18403 18403->18401 18405 7ff736124412 GetProcAddress 18403->18405 18406 7ff736124395 18404->18406 18405->18401 18407 7ff73612443a GetProcAddress 18405->18407 18406->18326 18407->18401 18408 7ff736124462 GetProcAddress 18407->18408 18408->18401 18409 7ff73612448a GetProcAddress 18408->18409 18410 7ff7361244b2 GetProcAddress 18409->18410 18411 7ff7361244a6 18409->18411 18412 7ff7361244da GetProcAddress 18410->18412 18413 7ff7361244ce 18410->18413 18411->18410 18413->18412 18485 7ff736123f85 18483->18485 18484 7ff736123f8d 18484->18345 18485->18484 18488 7ff73612411f 18485->18488 18525 7ff7361370b8 18485->18525 18486 7ff7361242ca __std_exception_destroy 18486->18345 18487 7ff7361233d0 47 API calls 18487->18488 18488->18486 18488->18487 18491 7ff7361236e0 18490->18491 18492 7ff73612b140 _wfindfirst32i64 8 API calls 18491->18492 18493 7ff736123742 18492->18493 18493->18351 18493->18352 18495 7ff736123a61 18494->18495 18497 7ff736123a04 18494->18497 18526 7ff7361370e8 18525->18526 18529 7ff7361365b4 18526->18529 18528 7ff736137118 18528->18485 18530 7ff7361365f7 18529->18530 18531 7ff7361365e5 18529->18531 18533 7ff736136641 18530->18533 18535 7ff736136604 18530->18535 18532 7ff736137af8 memcpy_s 11 API calls 18531->18532 18534 7ff7361365ea 18532->18534 18536 7ff73613665c 18533->18536 18540 7ff736134820 45 API calls 18533->18540 18538 7ff73613b014 _invalid_parameter_noinfo 37 API calls 18534->18538 18539 7ff73613af48 _invalid_parameter_noinfo 37 API calls 18535->18539 18541 7ff73613667e 18536->18541 18550 7ff736137040 18536->18550 18545 7ff7361365f5 18538->18545 18539->18545 18540->18536 18542 7ff73613671f 18541->18542 18543 7ff736137af8 memcpy_s 11 API calls 18541->18543 18544 7ff736137af8 memcpy_s 11 API calls 18542->18544 18542->18545 18546 7ff736136714 18543->18546 18547 7ff7361367ca 18544->18547 18545->18528 18548 7ff73613b014 _invalid_parameter_noinfo 37 API calls 18546->18548 18548->18542 18551 7ff73613707a 18550->18551 18552 7ff736137063 18550->18552 18554 7ff736137068 18551->18554 18561 7ff736140a18 18551->18561 18556 7ff7361409e8 18552->18556 18554->18536 18557 7ff73613b880 __CxxCallCatchBlock 45 API calls 18556->18557 18562 7ff736135a74 45 API calls 18561->18562 18563 7ff736140a51 18562->18563 18606 7ff73613b880 __CxxCallCatchBlock 45 API calls 18605->18606 18607 7ff73613aae1 18606->18607 18610 7ff73613ac0c 18607->18610 18619 7ff736143d60 18610->18619 18645 7ff736143d18 18619->18645 18650 7ff736140d58 EnterCriticalSection 18645->18650 19561 7ff73613b700 19562 7ff73613b71a 19561->19562 19563 7ff73613b705 19561->19563 19567 7ff73613b720 19563->19567 19568 7ff73613b76a 19567->19568 19569 7ff73613b762 19567->19569 19571 7ff73613b07c __free_lconv_mon 11 API calls 19568->19571 19570 7ff73613b07c __free_lconv_mon 11 API calls 19569->19570 19570->19568 19572 7ff73613b777 19571->19572 19573 7ff73613b07c __free_lconv_mon 11 API calls 19572->19573 19574 7ff73613b784 19573->19574 19575 7ff73613b07c __free_lconv_mon 11 API calls 19574->19575 19576 7ff73613b791 19575->19576 19577 7ff73613b07c __free_lconv_mon 11 API calls 19576->19577 19578 7ff73613b79e 19577->19578 19579 7ff73613b07c __free_lconv_mon 11 API calls 19578->19579 19580 7ff73613b7ab 19579->19580 19581 7ff73613b07c __free_lconv_mon 11 API calls 19580->19581 19582 7ff73613b7b8 19581->19582 19583 7ff73613b07c __free_lconv_mon 11 API calls 19582->19583 19584 7ff73613b7c5 19583->19584 19585 7ff73613b07c __free_lconv_mon 11 API calls 19584->19585 19586 7ff73613b7d5 19585->19586 19587 7ff73613b07c __free_lconv_mon 11 API calls 19586->19587 19588 7ff73613b7e5 19587->19588 19593 7ff73613b5c8 19588->19593 19607 7ff736140d58 EnterCriticalSection 19593->19607 15539 7ff73613fd8c 15540 7ff73613ff7e 15539->15540 15542 7ff73613fdce _isindst 15539->15542 15592 7ff736137af8 15540->15592 15542->15540 15545 7ff73613fe4e _isindst 15542->15545 15560 7ff7361469a4 15545->15560 15550 7ff73613ffaa 15604 7ff73613b034 IsProcessorFeaturePresent 15550->15604 15557 7ff73613feab 15559 7ff73613ff6e 15557->15559 15585 7ff7361469e8 15557->15585 15595 7ff73612b140 15559->15595 15561 7ff73613fe6c 15560->15561 15562 7ff7361469b3 15560->15562 15567 7ff736145da8 15561->15567 15608 7ff736140d58 EnterCriticalSection 15562->15608 15568 7ff736145db1 15567->15568 15572 7ff73613fe81 15567->15572 15569 7ff736137af8 memcpy_s 11 API calls 15568->15569 15570 7ff736145db6 15569->15570 15609 7ff73613b014 15570->15609 15572->15550 15573 7ff736145dd8 15572->15573 15574 7ff736145de1 15573->15574 15578 7ff73613fe92 15573->15578 15575 7ff736137af8 memcpy_s 11 API calls 15574->15575 15576 7ff736145de6 15575->15576 15577 7ff73613b014 _invalid_parameter_noinfo 37 API calls 15576->15577 15577->15578 15578->15550 15579 7ff736145e08 15578->15579 15580 7ff736145e11 15579->15580 15584 7ff73613fea3 15579->15584 15581 7ff736137af8 memcpy_s 11 API calls 15580->15581 15582 7ff736145e16 15581->15582 15583 7ff73613b014 _invalid_parameter_noinfo 37 API calls 15582->15583 15583->15584 15584->15550 15584->15557 15690 7ff736140d58 EnterCriticalSection 15585->15690 15691 7ff73613b9f8 GetLastError 15592->15691 15594 7ff736137b01 15594->15559 15596 7ff73612b149 15595->15596 15597 7ff73612b154 15596->15597 15598 7ff73612b1a0 IsProcessorFeaturePresent 15596->15598 15599 7ff73612b1b8 15598->15599 15708 7ff73612b394 RtlCaptureContext 15599->15708 15605 7ff73613b047 15604->15605 15713 7ff73613ad48 15605->15713 15611 7ff73613aeac 15609->15611 15612 7ff73613aed7 15611->15612 15615 7ff73613af48 15612->15615 15614 7ff73613aefe 15623 7ff73613ac90 15615->15623 15619 7ff73613af83 15619->15614 15621 7ff73613b034 _wfindfirst32i64 17 API calls 15622 7ff73613b013 15621->15622 15624 7ff73613ace7 15623->15624 15625 7ff73613acac GetLastError 15623->15625 15624->15619 15629 7ff73613acfc 15624->15629 15626 7ff73613acbc 15625->15626 15632 7ff73613bac0 15626->15632 15630 7ff73613ad18 GetLastError SetLastError 15629->15630 15631 7ff73613ad30 15629->15631 15630->15631 15631->15619 15631->15621 15633 7ff73613bafa FlsSetValue 15632->15633 15634 7ff73613badf FlsGetValue 15632->15634 15635 7ff73613bb07 15633->15635 15638 7ff73613acd7 SetLastError 15633->15638 15636 7ff73613baf4 15634->15636 15634->15638 15649 7ff73613f2e0 15635->15649 15636->15633 15638->15624 15640 7ff73613bb34 FlsSetValue 15643 7ff73613bb52 15640->15643 15644 7ff73613bb40 FlsSetValue 15640->15644 15641 7ff73613bb24 FlsSetValue 15642 7ff73613bb2d 15641->15642 15656 7ff73613b07c 15642->15656 15662 7ff73613b628 15643->15662 15644->15642 15654 7ff73613f2f1 memcpy_s 15649->15654 15650 7ff73613f342 15653 7ff736137af8 memcpy_s 10 API calls 15650->15653 15651 7ff73613f326 RtlAllocateHeap 15652 7ff73613bb16 15651->15652 15651->15654 15652->15640 15652->15641 15653->15652 15654->15650 15654->15651 15667 7ff736143ca0 15654->15667 15657 7ff73613b0b0 15656->15657 15658 7ff73613b081 RtlRestoreThreadPreferredUILanguages 15656->15658 15657->15638 15658->15657 15659 7ff73613b09c GetLastError 15658->15659 15660 7ff73613b0a9 __free_lconv_mon 15659->15660 15661 7ff736137af8 memcpy_s 9 API calls 15660->15661 15661->15657 15676 7ff73613b500 15662->15676 15670 7ff736143ce0 15667->15670 15675 7ff736140d58 EnterCriticalSection 15670->15675 15688 7ff736140d58 EnterCriticalSection 15676->15688 15692 7ff73613ba39 FlsSetValue 15691->15692 15697 7ff73613ba1c 15691->15697 15693 7ff73613ba4b 15692->15693 15696 7ff73613ba29 15692->15696 15695 7ff73613f2e0 memcpy_s 5 API calls 15693->15695 15694 7ff73613baa5 SetLastError 15694->15594 15698 7ff73613ba5a 15695->15698 15696->15694 15697->15692 15697->15696 15699 7ff73613ba78 FlsSetValue 15698->15699 15700 7ff73613ba68 FlsSetValue 15698->15700 15701 7ff73613ba96 15699->15701 15702 7ff73613ba84 FlsSetValue 15699->15702 15703 7ff73613ba71 15700->15703 15704 7ff73613b628 memcpy_s 5 API calls 15701->15704 15702->15703 15705 7ff73613b07c __free_lconv_mon 5 API calls 15703->15705 15706 7ff73613ba9e 15704->15706 15705->15696 15707 7ff73613b07c __free_lconv_mon 5 API calls 15706->15707 15707->15694 15709 7ff73612b3ae RtlLookupFunctionEntry 15708->15709 15710 7ff73612b1cb 15709->15710 15711 7ff73612b3c4 RtlVirtualUnwind 15709->15711 15712 7ff73612b160 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15710->15712 15711->15709 15711->15710 15714 7ff73613ad82 _wfindfirst32i64 memcpy_s 15713->15714 15715 7ff73613adaa RtlCaptureContext RtlLookupFunctionEntry 15714->15715 15716 7ff73613ae1a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15715->15716 15717 7ff73613ade4 RtlVirtualUnwind 15715->15717 15718 7ff73613ae6c _wfindfirst32i64 15716->15718 15717->15716 15719 7ff73612b140 _wfindfirst32i64 8 API calls 15718->15719 15720 7ff73613ae8b GetCurrentProcess TerminateProcess 15719->15720 19624 7ff73612b410 19625 7ff73612b420 19624->19625 19641 7ff73613a2a8 19625->19641 19627 7ff73612b42c 19647 7ff73612b728 19627->19647 19629 7ff73612ba0c 7 API calls 19631 7ff73612b4c5 19629->19631 19630 7ff73612b444 _RTC_Initialize 19639 7ff73612b499 19630->19639 19652 7ff73612b8d8 19630->19652 19633 7ff73612b459 19655 7ff736139718 19633->19655 19639->19629 19640 7ff73612b4b5 19639->19640 19642 7ff73613a2b9 19641->19642 19643 7ff73613a2c1 19642->19643 19644 7ff736137af8 memcpy_s 11 API calls 19642->19644 19643->19627 19645 7ff73613a2d0 19644->19645 19646 7ff73613b014 _invalid_parameter_noinfo 37 API calls 19645->19646 19646->19643 19648 7ff73612b739 19647->19648 19651 7ff73612b73e __scrt_release_startup_lock 19647->19651 19649 7ff73612ba0c 7 API calls 19648->19649 19648->19651 19650 7ff73612b7b2 19649->19650 19651->19630 19680 7ff73612b89c 19652->19680 19654 7ff73612b8e1 19654->19633 19656 7ff736139738 19655->19656 19662 7ff73612b465 19655->19662 19657 7ff736139740 19656->19657 19658 7ff736139756 GetModuleFileNameW 19656->19658 19659 7ff736137af8 memcpy_s 11 API calls 19657->19659 19663 7ff736139781 19658->19663 19660 7ff736139745 19659->19660 19661 7ff73613b014 _invalid_parameter_noinfo 37 API calls 19660->19661 19661->19662 19662->19639 19679 7ff73612b9ac InitializeSListHead 19662->19679 19664 7ff7361396b8 11 API calls 19663->19664 19665 7ff7361397c1 19664->19665 19666 7ff7361397c9 19665->19666 19669 7ff7361397e1 19665->19669 19667 7ff736137af8 memcpy_s 11 API calls 19666->19667 19668 7ff7361397ce 19667->19668 19671 7ff73613b07c __free_lconv_mon 11 API calls 19668->19671 19670 7ff736139803 19669->19670 19673 7ff736139848 19669->19673 19674 7ff73613982f 19669->19674 19672 7ff73613b07c __free_lconv_mon 11 API calls 19670->19672 19671->19662 19672->19662 19676 7ff73613b07c __free_lconv_mon 11 API calls 19673->19676 19675 7ff73613b07c __free_lconv_mon 11 API calls 19674->19675 19677 7ff736139838 19675->19677 19676->19670 19678 7ff73613b07c __free_lconv_mon 11 API calls 19677->19678 19678->19662 19681 7ff73612b8b6 19680->19681 19683 7ff73612b8af 19680->19683 19684 7ff73613a8ec 19681->19684 19683->19654 19687 7ff73613a528 19684->19687 19694 7ff736140d58 EnterCriticalSection 19687->19694 19026 7ff736148590 19029 7ff736142d00 19026->19029 19030 7ff736142d52 19029->19030 19031 7ff736142d0d 19029->19031 19035 7ff73613b954 19031->19035 19036 7ff73613b980 FlsSetValue 19035->19036 19037 7ff73613b965 FlsGetValue 19035->19037 19038 7ff73613b98d 19036->19038 19039 7ff73613b972 19036->19039 19037->19039 19040 7ff73613b97a 19037->19040 19041 7ff73613f2e0 memcpy_s 11 API calls 19038->19041 19042 7ff73613ac0c __CxxCallCatchBlock 45 API calls 19039->19042 19045 7ff73613b978 19039->19045 19040->19036 19044 7ff73613b99c 19041->19044 19043 7ff73613b9f5 19042->19043 19046 7ff73613b9ba FlsSetValue 19044->19046 19047 7ff73613b9aa FlsSetValue 19044->19047 19055 7ff7361429d4 19045->19055 19049 7ff73613b9d8 19046->19049 19050 7ff73613b9c6 FlsSetValue 19046->19050 19048 7ff73613b9b3 19047->19048 19051 7ff73613b07c __free_lconv_mon 11 API calls 19048->19051 19052 7ff73613b628 memcpy_s 11 API calls 19049->19052 19050->19048 19051->19039 19053 7ff73613b9e0 19052->19053 19054 7ff73613b07c __free_lconv_mon 11 API calls 19053->19054 19054->19045 19078 7ff736142c44 19055->19078 19057 7ff736142a09 19093 7ff7361426d4 19057->19093 19060 7ff73613dd2c _fread_nolock 12 API calls 19061 7ff736142a37 19060->19061 19062 7ff736142a3f 19061->19062 19064 7ff736142a4e 19061->19064 19063 7ff73613b07c __free_lconv_mon 11 API calls 19062->19063 19077 7ff736142a26 19063->19077 19100 7ff736142d7c 19064->19100 19067 7ff736142b4a 19068 7ff736137af8 memcpy_s 11 API calls 19067->19068 19070 7ff736142b4f 19068->19070 19069 7ff736142ba5 19072 7ff736142c0c 19069->19072 19111 7ff736142504 19069->19111 19073 7ff73613b07c __free_lconv_mon 11 API calls 19070->19073 19071 7ff736142b64 19071->19069 19074 7ff73613b07c __free_lconv_mon 11 API calls 19071->19074 19076 7ff73613b07c __free_lconv_mon 11 API calls 19072->19076 19073->19077 19074->19069 19076->19077 19077->19030 19079 7ff736142c67 19078->19079 19080 7ff736142c71 19079->19080 19126 7ff736140d58 EnterCriticalSection 19079->19126 19084 7ff736142ce3 19080->19084 19085 7ff73613ac0c __CxxCallCatchBlock 45 API calls 19080->19085 19084->19057 19088 7ff736142cfb 19085->19088 19087 7ff736142d52 19087->19057 19088->19087 19090 7ff73613b954 50 API calls 19088->19090 19091 7ff736142d3c 19090->19091 19092 7ff7361429d4 65 API calls 19091->19092 19092->19087 19094 7ff736135a74 45 API calls 19093->19094 19095 7ff7361426e8 19094->19095 19096 7ff736142706 19095->19096 19097 7ff7361426f4 GetOEMCP 19095->19097 19098 7ff73614271b 19096->19098 19099 7ff73614270b GetACP 19096->19099 19097->19098 19098->19060 19098->19077 19099->19098 19101 7ff7361426d4 47 API calls 19100->19101 19102 7ff736142da9 19101->19102 19103 7ff736142eff 19102->19103 19105 7ff736142de6 IsValidCodePage 19102->19105 19109 7ff736142e00 memcpy_s 19102->19109 19104 7ff73612b140 _wfindfirst32i64 8 API calls 19103->19104 19106 7ff736142b41 19104->19106 19105->19103 19107 7ff736142df7 19105->19107 19106->19067 19106->19071 19108 7ff736142e26 GetCPInfo 19107->19108 19107->19109 19108->19103 19108->19109 19127 7ff7361427ec 19109->19127 19183 7ff736140d58 EnterCriticalSection 19111->19183 19128 7ff736142829 GetCPInfo 19127->19128 19129 7ff73614291f 19127->19129 19128->19129 19133 7ff73614283c 19128->19133 19130 7ff73612b140 _wfindfirst32i64 8 API calls 19129->19130 19132 7ff7361429be 19130->19132 19131 7ff736143550 48 API calls 19134 7ff7361428b3 19131->19134 19132->19103 19133->19131 19138 7ff7361484f4 19134->19138 19137 7ff7361484f4 54 API calls 19137->19129 19139 7ff736135a74 45 API calls 19138->19139 19140 7ff736148519 19139->19140 19143 7ff7361481c0 19140->19143 19144 7ff736148201 19143->19144 19145 7ff73613fca0 _fread_nolock MultiByteToWideChar 19144->19145 19149 7ff73614824b 19145->19149 19146 7ff7361484c9 19147 7ff73612b140 _wfindfirst32i64 8 API calls 19146->19147 19148 7ff7361428e6 19147->19148 19148->19137 19149->19146 19150 7ff73613dd2c _fread_nolock 12 API calls 19149->19150 19151 7ff736148381 19149->19151 19152 7ff736148283 19149->19152 19150->19152 19151->19146 19153 7ff73613b07c __free_lconv_mon 11 API calls 19151->19153 19152->19151 19154 7ff73613fca0 _fread_nolock MultiByteToWideChar 19152->19154 19153->19146 19155 7ff7361482f6 19154->19155 19155->19151 19174 7ff73613f72c 19155->19174 19158 7ff736148341 19158->19151 19160 7ff73613f72c __crtLCMapStringW 6 API calls 19158->19160 19159 7ff736148392 19161 7ff73613dd2c _fread_nolock 12 API calls 19159->19161 19162 7ff736148464 19159->19162 19164 7ff7361483b0 19159->19164 19160->19151 19161->19164 19162->19151 19163 7ff73613b07c __free_lconv_mon 11 API calls 19162->19163 19163->19151 19164->19151 19165 7ff73613f72c __crtLCMapStringW 6 API calls 19164->19165 19166 7ff736148430 19165->19166 19166->19162 19167 7ff736148466 19166->19167 19168 7ff736148450 19166->19168 19170 7ff736140568 WideCharToMultiByte 19167->19170 19169 7ff736140568 WideCharToMultiByte 19168->19169 19171 7ff73614845e 19169->19171 19170->19171 19171->19162 19172 7ff73614847e 19171->19172 19172->19151 19173 7ff73613b07c __free_lconv_mon 11 API calls 19172->19173 19173->19151 19175 7ff73613f358 __crtLCMapStringW 5 API calls 19174->19175 19176 7ff73613f76a 19175->19176 19177 7ff73613f772 19176->19177 19180 7ff73613f818 19176->19180 19177->19151 19177->19158 19177->19159 19179 7ff73613f7db LCMapStringW 19179->19177 19181 7ff73613f358 __crtLCMapStringW 5 API calls 19180->19181 19182 7ff73613f846 __crtLCMapStringW 19181->19182 19182->19179 18654 7ff73613a061 18655 7ff73613aad8 45 API calls 18654->18655 18656 7ff73613a066 18655->18656 18657 7ff73613a0d7 18656->18657 18658 7ff73613a08d GetModuleHandleW 18656->18658 18666 7ff736139f64 18657->18666 18658->18657 18663 7ff73613a09a 18658->18663 18663->18657 18680 7ff73613a188 GetModuleHandleExW 18663->18680 18686 7ff736140d58 EnterCriticalSection 18666->18686 18681 7ff73613a1bc GetProcAddress 18680->18681 18682 7ff73613a1e5 18680->18682 18683 7ff73613a1ce 18681->18683 18684 7ff73613a1ea FreeLibrary 18682->18684 18685 7ff73613a1f1 18682->18685 18683->18682 18684->18685 18685->18657 19187 7ff736141b70 19205 7ff736140d58 EnterCriticalSection 19187->19205

                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                    Function 00007FF736146410 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 310 7ff736146410-7ff73614644b call 7ff736145d98 call 7ff736145da0 call 7ff736145e08 317 7ff736146451-7ff73614645c call 7ff736145da8 310->317 318 7ff736146675-7ff7361466c1 call 7ff73613b034 call 7ff736145d98 call 7ff736145da0 call 7ff736145e08 310->318 317->318 324 7ff736146462-7ff73614646c 317->324 344 7ff7361466c7-7ff7361466d2 call 7ff736145da8 318->344 345 7ff7361467ff-7ff73614686d call 7ff73613b034 call 7ff736141c88 318->345 326 7ff73614648e-7ff736146492 324->326 327 7ff73614646e-7ff736146471 324->327 330 7ff736146495-7ff73614649d 326->330 329 7ff736146474-7ff73614647f 327->329 332 7ff73614648a-7ff73614648c 329->332 333 7ff736146481-7ff736146488 329->333 330->330 334 7ff73614649f-7ff7361464b2 call 7ff73613dd2c 330->334 332->326 336 7ff7361464bb-7ff7361464c9 332->336 333->329 333->332 340 7ff7361464ca-7ff7361464d6 call 7ff73613b07c 334->340 341 7ff7361464b4-7ff7361464b6 call 7ff73613b07c 334->341 350 7ff7361464dd-7ff7361464e5 340->350 341->336 344->345 354 7ff7361466d8-7ff7361466e3 call 7ff736145dd8 344->354 362 7ff73614687b-7ff73614687e 345->362 363 7ff73614686f-7ff736146876 345->363 350->350 353 7ff7361464e7-7ff7361464f8 call 7ff736140ef4 350->353 353->318 364 7ff7361464fe-7ff736146554 call 7ff73612c860 * 4 call 7ff73614632c 353->364 354->345 365 7ff7361466e9-7ff73614670c call 7ff73613b07c GetTimeZoneInformation 354->365 367 7ff736146880 362->367 368 7ff7361468b5-7ff7361468c8 call 7ff73613dd2c 362->368 366 7ff73614690b-7ff73614690e 363->366 422 7ff736146556-7ff73614655a 364->422 376 7ff736146712-7ff736146733 365->376 377 7ff7361467d4-7ff7361467fe call 7ff736145d90 call 7ff736145d80 call 7ff736145d88 365->377 371 7ff736146883 call 7ff73614668c 366->371 373 7ff736146914-7ff73614691c call 7ff736146410 366->373 367->371 382 7ff7361468ca 368->382 383 7ff7361468d3-7ff7361468ee call 7ff736141c88 368->383 387 7ff736146888-7ff7361468b4 call 7ff73613b07c call 7ff73612b140 371->387 373->387 384 7ff73614673e-7ff736146745 376->384 385 7ff736146735-7ff73614673b 376->385 390 7ff7361468cc-7ff7361468d1 call 7ff73613b07c 382->390 406 7ff7361468f0-7ff7361468f3 383->406 407 7ff7361468f5-7ff736146907 call 7ff73613b07c 383->407 391 7ff736146759 384->391 392 7ff736146747-7ff73614674f 384->392 385->384 390->367 403 7ff73614675b-7ff7361467cf call 7ff73612c860 * 4 call 7ff73614326c call 7ff736146924 * 2 391->403 392->391 398 7ff736146751-7ff736146757 392->398 398->403 403->377 406->390 407->366 424 7ff73614655c 422->424 425 7ff736146560-7ff736146564 422->425 424->425 425->422 427 7ff736146566-7ff73614658b call 7ff73613716c 425->427 433 7ff73614658e-7ff736146592 427->433 436 7ff7361465a1-7ff7361465a5 433->436 437 7ff736146594-7ff73614659f 433->437 436->433 437->436 439 7ff7361465a7-7ff7361465ab 437->439 441 7ff7361465ad-7ff7361465d5 call 7ff73613716c 439->441 442 7ff73614662c-7ff736146630 439->442 450 7ff7361465d7 441->450 451 7ff7361465f3-7ff7361465f7 441->451 443 7ff736146637-7ff736146644 442->443 444 7ff736146632-7ff736146634 442->444 446 7ff73614665f-7ff73614666e call 7ff736145d90 call 7ff736145d80 443->446 447 7ff736146646-7ff73614665c call 7ff73614632c 443->447 444->443 446->318 447->446 455 7ff7361465da-7ff7361465e1 450->455 451->442 453 7ff7361465f9-7ff736146617 call 7ff73613716c 451->453 462 7ff736146623-7ff73614662a 453->462 455->451 459 7ff7361465e3-7ff7361465f1 455->459 459->451 459->455 462->442 463 7ff736146619-7ff73614661d 462->463 463->442 464 7ff73614661f 463->464 464->462
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF736146455
                                                                                                                                                                                                      • Part of subcall function 00007FF736145DA8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF736145DBC
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B07C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B092
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B07C: GetLastError.KERNEL32(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B09C
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B034: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73613B013,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613B03D
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B034: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF73613B013,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613B062
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF736146444
                                                                                                                                                                                                      • Part of subcall function 00007FF736145E08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF736145E1C
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF7361466BA
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF7361466CB
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF7361466DC
                                                                                                                                                                                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73614691C), ref: 00007FF736146703
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                                                                                                                                                                                    • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                                    • API String ID: 1458651798-690618308
                                                                                                                                                                                                    • Opcode ID: 669756ba8018b8d3057448b200b0a665972091fe16188bca838b36c5b614fcf7
                                                                                                                                                                                                    • Instruction ID: c2a535abc7f54c048fd7b304cf6bb941e1e637c05516e685e3e19dfc1a36f94e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 669756ba8018b8d3057448b200b0a665972091fe16188bca838b36c5b614fcf7
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E3D10226A18262A5F721BF26FC519BBA771EF44B88FC04035DA4D47685EF3CE451E3A0
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736126B00 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 141COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetTempPathW.KERNEL32(00000000,00000000,00000000,00000000,?,00007FF73612154F), ref: 00007FF736126B97
                                                                                                                                                                                                    • GetCurrentProcessId.KERNEL32 ref: 00007FF736126B9D
                                                                                                                                                                                                      • Part of subcall function 00007FF736126D10: GetEnvironmentVariableW.KERNEL32(00007FF736122AEC), ref: 00007FF736126D4A
                                                                                                                                                                                                      • Part of subcall function 00007FF736126D10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF736126D67
                                                                                                                                                                                                      • Part of subcall function 00007FF736137F60: _invalid_parameter_noinfo.LIBCMT ref: 00007FF736137F79
                                                                                                                                                                                                    • SetEnvironmentVariableW.KERNEL32 ref: 00007FF736126C51
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                    • API String ID: 1556224225-1116378104
                                                                                                                                                                                                    • Opcode ID: 9c59987e52d34f39274508009370614b29ffb7fb8e518994d0cc1e261b8a17ed
                                                                                                                                                                                                    • Instruction ID: f1e3653a0f07a7129c548b7a0cffe95aeecb80a7222e461f8808cb8e41c18c70
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9c59987e52d34f39274508009370614b29ffb7fb8e518994d0cc1e261b8a17ed
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5A51A121B1D21BA1FE15BB22BC15ABBD262AF45FC0FD44430ED0E477DAED6CE0116260
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73614735C Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 564 7ff73614735c-7ff7361473cf call 7ff736147090 567 7ff7361473e9-7ff7361473f3 call 7ff7361385a8 564->567 568 7ff7361473d1-7ff7361473da call 7ff736137ad8 564->568 574 7ff73614740e-7ff736147477 CreateFileW 567->574 575 7ff7361473f5-7ff73614740c call 7ff736137ad8 call 7ff736137af8 567->575 573 7ff7361473dd-7ff7361473e4 call 7ff736137af8 568->573 588 7ff73614772a-7ff73614774a 573->588 576 7ff736147479-7ff73614747f 574->576 577 7ff7361474f4-7ff7361474ff GetFileType 574->577 575->573 580 7ff7361474c1-7ff7361474ef GetLastError call 7ff736137a6c 576->580 581 7ff736147481-7ff736147485 576->581 583 7ff736147552-7ff736147559 577->583 584 7ff736147501-7ff73614753c GetLastError call 7ff736137a6c CloseHandle 577->584 580->573 581->580 586 7ff736147487-7ff7361474bf CreateFileW 581->586 591 7ff73614755b-7ff73614755f 583->591 592 7ff736147561-7ff736147564 583->592 584->573 599 7ff736147542-7ff73614754d call 7ff736137af8 584->599 586->577 586->580 593 7ff73614756a-7ff7361475bf call 7ff7361384c0 591->593 592->593 594 7ff736147566 592->594 602 7ff7361475de-7ff73614760f call 7ff736146e10 593->602 603 7ff7361475c1-7ff7361475cd call 7ff736147298 593->603 594->593 599->573 610 7ff736147611-7ff736147613 602->610 611 7ff736147615-7ff736147657 602->611 603->602 609 7ff7361475cf 603->609 612 7ff7361475d1-7ff7361475d9 call 7ff73613b1f4 609->612 610->612 613 7ff736147679-7ff736147684 611->613 614 7ff736147659-7ff73614765d 611->614 612->588 616 7ff73614768a-7ff73614768e 613->616 617 7ff736147728 613->617 614->613 615 7ff73614765f-7ff736147674 614->615 615->613 616->617 619 7ff736147694-7ff7361476d9 CloseHandle CreateFileW 616->619 617->588 621 7ff73614770e-7ff736147723 619->621 622 7ff7361476db-7ff736147709 GetLastError call 7ff736137a6c call 7ff7361386e8 619->622 621->617 622->621
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1617910340-0
                                                                                                                                                                                                    • Opcode ID: 8b1773080454bc0ef48e163fdf91a6480f0fab04aa5c897d6d482e1b8b0bdf6f
                                                                                                                                                                                                    • Instruction ID: aced4ecdb0c64556018202588d9f29855ccebdd1e9ae211141f0a5e4bcac67dc
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8b1773080454bc0ef48e163fdf91a6480f0fab04aa5c897d6d482e1b8b0bdf6f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 33C1E233B28A5195FB11EF68E884AAE7771E748B98F510235DE2E5B394DF38E052D310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73614668C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 826 7ff73614668c-7ff7361466c1 call 7ff736145d98 call 7ff736145da0 call 7ff736145e08 833 7ff7361466c7-7ff7361466d2 call 7ff736145da8 826->833 834 7ff7361467ff-7ff73614686d call 7ff73613b034 call 7ff736141c88 826->834 833->834 839 7ff7361466d8-7ff7361466e3 call 7ff736145dd8 833->839 845 7ff73614687b-7ff73614687e 834->845 846 7ff73614686f-7ff736146876 834->846 839->834 847 7ff7361466e9-7ff73614670c call 7ff73613b07c GetTimeZoneInformation 839->847 849 7ff736146880 845->849 850 7ff7361468b5-7ff7361468c8 call 7ff73613dd2c 845->850 848 7ff73614690b-7ff73614690e 846->848 856 7ff736146712-7ff736146733 847->856 857 7ff7361467d4-7ff7361467fe call 7ff736145d90 call 7ff736145d80 call 7ff736145d88 847->857 852 7ff736146883 call 7ff73614668c 848->852 853 7ff736146914-7ff73614691c call 7ff736146410 848->853 849->852 861 7ff7361468ca 850->861 862 7ff7361468d3-7ff7361468ee call 7ff736141c88 850->862 866 7ff736146888-7ff7361468b4 call 7ff73613b07c call 7ff73612b140 852->866 853->866 863 7ff73614673e-7ff736146745 856->863 864 7ff736146735-7ff73614673b 856->864 868 7ff7361468cc-7ff7361468d1 call 7ff73613b07c 861->868 882 7ff7361468f0-7ff7361468f3 862->882 883 7ff7361468f5-7ff736146907 call 7ff73613b07c 862->883 869 7ff736146759 863->869 870 7ff736146747-7ff73614674f 863->870 864->863 868->849 879 7ff73614675b-7ff7361467cf call 7ff73612c860 * 4 call 7ff73614326c call 7ff736146924 * 2 869->879 870->869 875 7ff736146751-7ff736146757 870->875 875->879 879->857 882->868 883->848
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF7361466BA
                                                                                                                                                                                                      • Part of subcall function 00007FF736145E08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF736145E1C
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF7361466CB
                                                                                                                                                                                                      • Part of subcall function 00007FF736145DA8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF736145DBC
                                                                                                                                                                                                    • _get_daylight.LIBCMT ref: 00007FF7361466DC
                                                                                                                                                                                                      • Part of subcall function 00007FF736145DD8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF736145DEC
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B07C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B092
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B07C: GetLastError.KERNEL32(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B09C
                                                                                                                                                                                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73614691C), ref: 00007FF736146703
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                                                                                                                                                                                    • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                                    • API String ID: 2248164782-690618308
                                                                                                                                                                                                    • Opcode ID: 66ced4e6b830a9aba5d7142476c7f16333b9d6c0743f4fe81bfd4be4e8b6b4b5
                                                                                                                                                                                                    • Instruction ID: 4a02874ab9e9808f1f96dace4acefd1dc89117bebf267699c462dcd7718c640c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 66ced4e6b830a9aba5d7142476c7f16333b9d6c0743f4fe81bfd4be4e8b6b4b5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 55519136A18252A6F750FF25FC919ABE771BF48784F804139DA4D83695EF3CE410A7A0
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127B30 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Find$CloseFileFirst
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2295610775-0
                                                                                                                                                                                                    • Opcode ID: 1f441ceb78fef2ff28119626b2201a2c51414909abc6a7ea76b7e95948d584b0
                                                                                                                                                                                                    • Instruction ID: 9ec6ef64ed6b3694a536dd4702d7b67621dd26914629356833a2759f0eae2725
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1f441ceb78fef2ff28119626b2201a2c51414909abc6a7ea76b7e95948d584b0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 79F08122A18685CAF7A0AF64B849B67B371AB44724F804335D66D066D4DF3CD048AB10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736121710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 0 7ff736121710-7ff736121724 1 7ff73612173e-7ff736121742 0->1 2 7ff736121726-7ff73612173d call 7ff736121fb0 0->2 4 7ff736121768-7ff73612178b call 7ff736126dc0 1->4 5 7ff736121744-7ff73612174d call 7ff7361212b0 1->5 11 7ff7361217b9-7ff7361217d4 call 7ff736123150 4->11 12 7ff73612178d-7ff7361217b8 call 7ff736121f70 4->12 13 7ff73612175f-7ff736121767 5->13 14 7ff73612174f-7ff73612175a call 7ff736121fb0 5->14 20 7ff7361217ee-7ff736121801 call 7ff73612fc84 11->20 21 7ff7361217d6-7ff7361217e9 call 7ff736121fb0 11->21 14->13 27 7ff736121823-7ff736121827 20->27 28 7ff736121803-7ff73612181e call 7ff736121f70 20->28 26 7ff73612192f-7ff736121932 call 7ff73612f5fc 21->26 33 7ff736121937-7ff73612194e 26->33 30 7ff736121829-7ff736121835 call 7ff736121050 27->30 31 7ff736121841-7ff736121861 call 7ff73613513c 27->31 37 7ff736121927-7ff73612192a call 7ff73612f5fc 28->37 38 7ff73612183a-7ff73612183c 30->38 40 7ff736121882-7ff736121888 31->40 41 7ff736121863-7ff73612187d call 7ff736121f70 31->41 37->26 38->37 44 7ff73612188e-7ff736121897 40->44 45 7ff736121915-7ff736121918 call 7ff736135128 40->45 49 7ff73612191d-7ff736121922 41->49 48 7ff7361218a0-7ff7361218c2 call 7ff73612f94c 44->48 45->49 52 7ff7361218c4-7ff7361218dc call 7ff73613008c 48->52 53 7ff7361218f5-7ff7361218fc 48->53 49->37 58 7ff7361218de-7ff7361218e1 52->58 59 7ff7361218e5-7ff7361218f3 52->59 55 7ff736121903-7ff73612190b call 7ff736121f70 53->55 62 7ff736121910 55->62 58->48 61 7ff7361218e3 58->61 59->55 61->62 62->45
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                                                                                                                                                    • API String ID: 0-3833288071
                                                                                                                                                                                                    • Opcode ID: abae38b9ce83d605d6f57777afdde0b755acc1e8f5efaf4bfcfae81c5d64c5d5
                                                                                                                                                                                                    • Instruction ID: 9b71b0f91bbd173f3d14f71cf1c287b7c860021e2dd3ec35ba7e51447221457b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: abae38b9ce83d605d6f57777afdde0b755acc1e8f5efaf4bfcfae81c5d64c5d5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 50519E61B0C64AE2FA51FB11FC41AABE7A2BF457D4FC40131DE0C47695EE2CE654A320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736121000 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 315COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 63 7ff736121000-7ff736122aab call 7ff73612f3d0 call 7ff73612f3c8 call 7ff7361278c0 call 7ff73612b0e0 call 7ff736135300 call 7ff736135f6c call 7ff736121e50 79 7ff736122ab1-7ff736122ac1 call 7ff736123040 63->79 80 7ff736122b96 63->80 79->80 86 7ff736122ac7-7ff736122ada call 7ff736122f10 79->86 81 7ff736122b9b-7ff736122bc4 call 7ff73612b140 80->81 86->80 89 7ff736122ae0-7ff736122afe call 7ff736126d10 86->89 92 7ff736122b40-7ff736122b60 call 7ff7361271f0 call 7ff736121c50 89->92 93 7ff736122b00-7ff736122b0f call 7ff736126d10 89->93 103 7ff736122c3e-7ff736122c53 call 7ff7361219a0 92->103 104 7ff736122b66-7ff736122b7c call 7ff736121c50 92->104 93->92 99 7ff736122b11-7ff736122b17 93->99 101 7ff736122b19-7ff736122b21 99->101 102 7ff736122b23-7ff736122b3d call 7ff736135128 call 7ff7361271f0 99->102 101->102 102->92 114 7ff736122c87-7ff736122c98 103->114 115 7ff736122c55-7ff736122c66 call 7ff736135fb0 103->115 112 7ff736122b7e-7ff736122b91 call 7ff736121fb0 104->112 113 7ff736122bc5-7ff736122bc8 104->113 112->80 113->103 120 7ff736122bca-7ff736122be1 call 7ff736123150 113->120 118 7ff736122c9a-7ff736122ca1 114->118 119 7ff736122cb4-7ff736122cb7 114->119 132 7ff736122c68 call 7ff736127a60 115->132 133 7ff736122c6f-7ff736122c80 call 7ff736135fb0 115->133 118->119 122 7ff736122ca3-7ff736122ca6 call 7ff7361214f0 118->122 123 7ff736122cb9-7ff736122cc0 119->123 124 7ff736122cce-7ff736122ce6 call 7ff736127f60 119->124 139 7ff736122be8-7ff736122c14 call 7ff736127460 120->139 140 7ff736122be3-7ff736122be6 120->140 138 7ff736122cab-7ff736122cae 122->138 129 7ff736122cc2-7ff736122ccc 123->129 130 7ff736122d06-7ff736122d13 call 7ff736125f90 123->130 144 7ff736122ce8-7ff736122cf4 call 7ff736121fb0 124->144 145 7ff736122cf9-7ff736122d00 SetDllDirectoryW 124->145 129->124 129->130 152 7ff736122d5e-7ff736122d63 call 7ff736125f10 130->152 153 7ff736122d15-7ff736122d22 call 7ff736125c40 130->153 142 7ff736122c6d 132->142 133->114 150 7ff736122c82 call 7ff736127bb0 133->150 138->80 138->119 139->103 154 7ff736122c16-7ff736122c1e call 7ff73612f5fc 139->154 141 7ff736122c23-7ff736122c39 call 7ff736121fb0 140->141 141->80 142->114 144->80 145->130 150->114 161 7ff736122d68-7ff736122d6b 152->161 153->152 166 7ff736122d24-7ff736122d33 call 7ff7361257a0 153->166 154->141 164 7ff736122e4d-7ff736122e5c call 7ff736122680 161->164 165 7ff736122d71-7ff736122d7f 161->165 164->80 174 7ff736122e62-7ff736122e89 call 7ff736127180 call 7ff736126d10 call 7ff7361227e0 164->174 168 7ff736122d80-7ff736122d8a 165->168 177 7ff736122d54-7ff736122d59 call 7ff7361259f0 166->177 178 7ff736122d35-7ff736122d41 call 7ff736125720 166->178 171 7ff736122d8c-7ff736122d91 168->171 172 7ff736122d93-7ff736122d95 168->172 171->168 171->172 175 7ff736122d97-7ff736122dba call 7ff736121e90 172->175 176 7ff736122de1-7ff736122de4 172->176 210 7ff736122e8b-7ff736122e9c call 7ff736135fb0 174->210 211 7ff736122ebd-7ff736122eed call 7ff736127230 call 7ff7361259f0 call 7ff736125f10 174->211 175->80 192 7ff736122dc0-7ff736122dca 175->192 180 7ff736122e18-7ff736122e48 call 7ff7361227e0 call 7ff736122620 call 7ff7361227d0 call 7ff7361259f0 call 7ff736125f10 176->180 181 7ff736122de6-7ff736122df7 call 7ff736135fb0 176->181 177->152 178->177 193 7ff736122d43-7ff736122d52 call 7ff736125de0 178->193 180->81 199 7ff736122df9-7ff736122dfe call 7ff736127a60 181->199 200 7ff736122e00-7ff736122e11 call 7ff736135fb0 181->200 197 7ff736122dd0-7ff736122ddf 192->197 193->161 197->176 197->197 199->180 200->180 213 7ff736122e13 call 7ff736127bb0 200->213 222 7ff736122e9e-7ff736122ea3 call 7ff736127a60 210->222 223 7ff736122ea5-7ff736122eb6 call 7ff736135fb0 210->223 234 7ff736122efb-7ff736122efe call 7ff736121e20 211->234 235 7ff736122eef-7ff736122ef6 call 7ff736126ef0 211->235 213->180 222->211 223->211 233 7ff736122eb8 call 7ff736127bb0 223->233 233->211 239 7ff736122f03-7ff736122f05 234->239 235->234 239->81
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                      • Part of subcall function 00007FF736123040: GetModuleFileNameW.KERNEL32(?,00007FF736122ABF), ref: 00007FF736123071
                                                                                                                                                                                                    • SetDllDirectoryW.KERNEL32 ref: 00007FF736122D00
                                                                                                                                                                                                      • Part of subcall function 00007FF736126D10: GetEnvironmentVariableW.KERNEL32(00007FF736122AEC), ref: 00007FF736126D4A
                                                                                                                                                                                                      • Part of subcall function 00007FF736126D10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF736126D67
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                    • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE$hide-early$hide-late$minimize-early$minimize-late$pyi-hide-console
                                                                                                                                                                                                    • API String ID: 2344891160-1364127678
                                                                                                                                                                                                    • Opcode ID: 089e99d17c33425eefeb0416175072c844fcf947e0a5546e639ef65abe5455c9
                                                                                                                                                                                                    • Instruction ID: 76806f24242e51bfd722c098b45432ad0da6b8cde0f9fc30172815048a58ef1a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 089e99d17c33425eefeb0416175072c844fcf947e0a5546e639ef65abe5455c9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CFD1A221A1C64FF1FA65BB21BC519BFD262BF44B84FC04031EA4D4769AEF2CE505A724
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127C10 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(0000000100000001,00007FF7361232CC,00007FF736126AC1,?,00007FF736126ED6,?,00007FF736121785), ref: 00007FF736127C50
                                                                                                                                                                                                    • OpenProcessToken.ADVAPI32(?,00007FF736126ED6,?,00007FF736121785), ref: 00007FF736127C61
                                                                                                                                                                                                    • GetTokenInformation.KERNELBASE(?,00007FF736126ED6(TokenIntegrityLevel),?,00007FF736121785), ref: 00007FF736127C83
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00007FF736121785), ref: 00007FF736127C8D
                                                                                                                                                                                                    • GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,?,00007FF736121785), ref: 00007FF736127CCA
                                                                                                                                                                                                    • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF736127CDC
                                                                                                                                                                                                    • FindCloseChangeNotification.KERNELBASE(?,00007FF736126ED6,?,00007FF736121785), ref: 00007FF736127CF4
                                                                                                                                                                                                    • LocalFree.KERNEL32(?,00007FF736126ED6,?,00007FF736121785), ref: 00007FF736127D26
                                                                                                                                                                                                    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF736127D4D
                                                                                                                                                                                                    • CreateDirectoryW.KERNELBASE(?,00007FF736126ED6,?,00007FF736121785), ref: 00007FF736127D5E
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
                                                                                                                                                                                                    • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                    • API String ID: 2187719417-2855260032
                                                                                                                                                                                                    • Opcode ID: ed76d30cf0ca53451b6ec054f29b365865b8ee42b8643f457723de0667ad0d28
                                                                                                                                                                                                    • Instruction ID: 925c3a187bdd5259ef026141fd25c8b6240e12ce3f6c0cbe3755a58e5a757d54
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ed76d30cf0ca53451b6ec054f29b365865b8ee42b8643f457723de0667ad0d28
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4741423261878692FB50AF21FC44AABA371FB84B94F840231EA6E876D5DF3CD444D710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736121A40 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _fread_nolock
                                                                                                                                                                                                    • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                    • API String ID: 840049012-1384898525
                                                                                                                                                                                                    • Opcode ID: 9f45a361351248ac97e6f35777543a241ef9743779f6a8c6603bfe815e6342fd
                                                                                                                                                                                                    • Instruction ID: 9f1c79eec55606114d5d1085cbdf67290755b92c6cae30bad2b58ba478879ec9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9f45a361351248ac97e6f35777543a241ef9743779f6a8c6603bfe815e6342fd
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B151AE71A08646E6FB54EF28F84197AB7B1EF48B84F958135DA0C83799EE3CE440E714
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127230 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                    • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                    • API String ID: 2895956056-3524285272
                                                                                                                                                                                                    • Opcode ID: dc828d024e9550bdb519c06bd4d6f90c90a08b3d8329c6c0129a9ed76d5a21bc
                                                                                                                                                                                                    • Instruction ID: e67ff53ef24870f679f710fef9e23daa62394ed6c3d7b3e5f7249a1afb85f9ba
                                                                                                                                                                                                    • Opcode Fuzzy Hash: dc828d024e9550bdb519c06bd4d6f90c90a08b3d8329c6c0129a9ed76d5a21bc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 94417232A0878591EA20AB24F8456ABF371FF94360F900335E6AE43BD9EF7CD0449B10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736121050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 627 7ff736121050-7ff7361210ab call 7ff73612a960 630 7ff7361210ad-7ff7361210d2 call 7ff736121fb0 627->630 631 7ff7361210d3-7ff7361210eb call 7ff73613513c 627->631 636 7ff736121109-7ff736121119 call 7ff73613513c 631->636 637 7ff7361210ed-7ff736121104 call 7ff736121f70 631->637 643 7ff736121137-7ff736121147 636->643 644 7ff73612111b-7ff736121132 call 7ff736121f70 636->644 642 7ff73612126c-7ff736121281 call 7ff73612a640 call 7ff736135128 * 2 637->642 660 7ff736121286-7ff7361212a0 642->660 646 7ff736121150-7ff736121175 call 7ff73612f94c 643->646 644->642 654 7ff73612117b-7ff736121185 call 7ff73612f6c0 646->654 655 7ff73612125e 646->655 654->655 661 7ff73612118b-7ff736121197 654->661 657 7ff736121264 655->657 657->642 662 7ff7361211a0-7ff7361211c8 call 7ff736128e10 661->662 665 7ff7361211ca-7ff7361211cd 662->665 666 7ff736121241-7ff73612125c call 7ff736121fb0 662->666 667 7ff73612123c 665->667 668 7ff7361211cf-7ff7361211d9 665->668 666->657 667->666 670 7ff7361211db-7ff7361211e8 call 7ff73613008c 668->670 671 7ff736121203-7ff736121206 668->671 678 7ff7361211ed-7ff7361211f0 670->678 674 7ff736121208-7ff736121216 call 7ff73612bea0 671->674 675 7ff736121219-7ff73612121e 671->675 674->675 675->662 677 7ff736121220-7ff736121223 675->677 680 7ff736121237-7ff73612123a 677->680 681 7ff736121225-7ff736121228 677->681 682 7ff7361211fe-7ff736121201 678->682 683 7ff7361211f2-7ff7361211fc call 7ff73612f6c0 678->683 680->657 681->666 684 7ff73612122a-7ff736121232 681->684 682->666 683->675 683->682 684->646
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                    • API String ID: 0-1655038675
                                                                                                                                                                                                    • Opcode ID: ef18957bc2efa13484c43351af7b4e44738e46a193e81235c54d69fe0d06ad47
                                                                                                                                                                                                    • Instruction ID: 9218e063cba709935ca0b15a0d066a3873004fce54ac6147aa68e8e24b46c76a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ef18957bc2efa13484c43351af7b4e44738e46a193e81235c54d69fe0d06ad47
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E551F462A08686A4FA60FB21BC41BBBE6A2FF45794FD44131EE4D87785EE3CE445D310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613F358 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • FreeLibrary.KERNEL32(?,?,?,00007FF73613F6F2,?,?,-00000018,00007FF73613B487,?,?,?,00007FF73613B37E,?,?,?,00007FF736136552), ref: 00007FF73613F4D4
                                                                                                                                                                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF73613F6F2,?,?,-00000018,00007FF73613B487,?,?,?,00007FF73613B37E,?,?,?,00007FF736136552), ref: 00007FF73613F4E0
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                    • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                    • API String ID: 3013587201-537541572
                                                                                                                                                                                                    • Opcode ID: ed2c0c49f385a4fe82cac06ea60963abc4cc693e26cb611f18b7798412eeb81d
                                                                                                                                                                                                    • Instruction ID: 5e62a2c655bd196df8a87196f217eb52765f145cc6bff26d784f969c2d5a7ae8
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ed2c0c49f385a4fe82cac06ea60963abc4cc693e26cb611f18b7798412eeb81d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C3412861B19602A9FA16EB16BD00D77A3A1BF04BE0F984135DE0E87784EF3DE445E324
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613C18C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 713 7ff73613c18c-7ff73613c1b2 714 7ff73613c1cd-7ff73613c1d1 713->714 715 7ff73613c1b4-7ff73613c1c8 call 7ff736137ad8 call 7ff736137af8 713->715 717 7ff73613c5a7-7ff73613c5b3 call 7ff736137ad8 call 7ff736137af8 714->717 718 7ff73613c1d7-7ff73613c1de 714->718 733 7ff73613c5be 715->733 735 7ff73613c5b9 call 7ff73613b014 717->735 718->717 721 7ff73613c1e4-7ff73613c212 718->721 721->717 722 7ff73613c218-7ff73613c21f 721->722 725 7ff73613c238-7ff73613c23b 722->725 726 7ff73613c221-7ff73613c233 call 7ff736137ad8 call 7ff736137af8 722->726 731 7ff73613c241-7ff73613c247 725->731 732 7ff73613c5a3-7ff73613c5a5 725->732 726->735 731->732 737 7ff73613c24d-7ff73613c250 731->737 736 7ff73613c5c1-7ff73613c5d8 732->736 733->736 735->733 737->726 740 7ff73613c252-7ff73613c277 737->740 742 7ff73613c2aa-7ff73613c2b1 740->742 743 7ff73613c279-7ff73613c27b 740->743 744 7ff73613c286-7ff73613c29d call 7ff736137ad8 call 7ff736137af8 call 7ff73613b014 742->744 745 7ff73613c2b3-7ff73613c2db call 7ff73613dd2c call 7ff73613b07c * 2 742->745 746 7ff73613c27d-7ff73613c284 743->746 747 7ff73613c2a2-7ff73613c2a8 743->747 774 7ff73613c430 744->774 776 7ff73613c2f8-7ff73613c323 call 7ff73613c9b4 745->776 777 7ff73613c2dd-7ff73613c2f3 call 7ff736137af8 call 7ff736137ad8 745->777 746->744 746->747 748 7ff73613c328-7ff73613c33f 747->748 751 7ff73613c3ba-7ff73613c3c4 call 7ff73614402c 748->751 752 7ff73613c341-7ff73613c349 748->752 763 7ff73613c3ca-7ff73613c3df 751->763 764 7ff73613c44e 751->764 752->751 755 7ff73613c34b-7ff73613c34d 752->755 755->751 761 7ff73613c34f-7ff73613c365 755->761 761->751 766 7ff73613c367-7ff73613c373 761->766 763->764 768 7ff73613c3e1-7ff73613c3f3 GetConsoleMode 763->768 772 7ff73613c453-7ff73613c473 ReadFile 764->772 766->751 770 7ff73613c375-7ff73613c377 766->770 768->764 773 7ff73613c3f5-7ff73613c3fd 768->773 770->751 775 7ff73613c379-7ff73613c391 770->775 778 7ff73613c479-7ff73613c481 772->778 779 7ff73613c56d-7ff73613c576 GetLastError 772->779 773->772 782 7ff73613c3ff-7ff73613c421 ReadConsoleW 773->782 785 7ff73613c433-7ff73613c43d call 7ff73613b07c 774->785 775->751 786 7ff73613c393-7ff73613c39f 775->786 776->748 777->774 778->779 780 7ff73613c487 778->780 783 7ff73613c578-7ff73613c58e call 7ff736137af8 call 7ff736137ad8 779->783 784 7ff73613c593-7ff73613c596 779->784 788 7ff73613c48e-7ff73613c4a3 780->788 790 7ff73613c442-7ff73613c44c 782->790 791 7ff73613c423 GetLastError 782->791 783->774 795 7ff73613c429-7ff73613c42b call 7ff736137a6c 784->795 796 7ff73613c59c-7ff73613c59e 784->796 785->736 786->751 794 7ff73613c3a1-7ff73613c3a3 786->794 788->785 798 7ff73613c4a5-7ff73613c4b0 788->798 790->788 791->795 794->751 802 7ff73613c3a5-7ff73613c3b5 794->802 795->774 796->785 805 7ff73613c4d7-7ff73613c4df 798->805 806 7ff73613c4b2-7ff73613c4cb call 7ff73613bda4 798->806 802->751 809 7ff73613c55b-7ff73613c568 call 7ff73613bbe4 805->809 810 7ff73613c4e1-7ff73613c4f3 805->810 813 7ff73613c4d0-7ff73613c4d2 806->813 809->813 814 7ff73613c54e-7ff73613c556 810->814 815 7ff73613c4f5 810->815 813->785 814->785 817 7ff73613c4fa-7ff73613c501 815->817 818 7ff73613c53d-7ff73613c548 817->818 819 7ff73613c503-7ff73613c507 817->819 818->814 820 7ff73613c509-7ff73613c510 819->820 821 7ff73613c523 819->821 820->821 822 7ff73613c512-7ff73613c516 820->822 823 7ff73613c529-7ff73613c539 821->823 822->821 825 7ff73613c518-7ff73613c521 822->825 823->817 824 7ff73613c53b 823->824 824->814 825->823
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: 52ecbf29c3caac1d284d63befd581ad95332f1127a0f2b2c5427ffdf3bba3fd2
                                                                                                                                                                                                    • Instruction ID: 8a78b4b152dafebaf656ddcedb036c82acd04c3be46bbea899c562536875ec1e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 52ecbf29c3caac1d284d63befd581ad95332f1127a0f2b2c5427ffdf3bba3fd2
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1DC1E622B0C686A1F611AB15BC44ABFBB61EB92B80FE50131D94F03391DF7EE455A720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613D690 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 936 7ff73613d690-7ff73613d6b5 937 7ff73613d6bb-7ff73613d6be 936->937 938 7ff73613d983 936->938 940 7ff73613d6f7-7ff73613d723 937->940 941 7ff73613d6c0-7ff73613d6f2 call 7ff73613af48 937->941 939 7ff73613d985-7ff73613d995 938->939 943 7ff73613d72e-7ff73613d734 940->943 944 7ff73613d725-7ff73613d72c 940->944 941->939 945 7ff73613d736-7ff73613d73f call 7ff73613ca50 943->945 946 7ff73613d744-7ff73613d759 call 7ff73614402c 943->946 944->941 944->943 945->946 951 7ff73613d75f-7ff73613d768 946->951 952 7ff73613d873-7ff73613d87c 946->952 951->952 955 7ff73613d76e-7ff73613d772 951->955 953 7ff73613d87e-7ff73613d884 952->953 954 7ff73613d8d0-7ff73613d8f5 WriteFile 952->954 958 7ff73613d8bc-7ff73613d8ce call 7ff73613d148 953->958 959 7ff73613d886-7ff73613d889 953->959 956 7ff73613d8f7-7ff73613d8fd GetLastError 954->956 957 7ff73613d900 954->957 960 7ff73613d774-7ff73613d77c call 7ff736134820 955->960 961 7ff73613d783-7ff73613d78e 955->961 956->957 962 7ff73613d903 957->962 984 7ff73613d860-7ff73613d867 958->984 963 7ff73613d8a8-7ff73613d8ba call 7ff73613d368 959->963 964 7ff73613d88b-7ff73613d88e 959->964 960->961 966 7ff73613d790-7ff73613d799 961->966 967 7ff73613d79f-7ff73613d7b4 GetConsoleMode 961->967 969 7ff73613d908 962->969 963->984 970 7ff73613d914-7ff73613d91e 964->970 971 7ff73613d894-7ff73613d8a6 call 7ff73613d24c 964->971 966->952 966->967 974 7ff73613d7ba-7ff73613d7c0 967->974 975 7ff73613d86c 967->975 977 7ff73613d90d 969->977 978 7ff73613d97c-7ff73613d981 970->978 979 7ff73613d920-7ff73613d925 970->979 971->984 982 7ff73613d849-7ff73613d85b call 7ff73613ccd0 974->982 983 7ff73613d7c6-7ff73613d7c9 974->983 975->952 977->970 978->939 985 7ff73613d927-7ff73613d92a 979->985 986 7ff73613d953-7ff73613d95d 979->986 982->984 989 7ff73613d7cb-7ff73613d7ce 983->989 990 7ff73613d7d4-7ff73613d7e2 983->990 984->969 993 7ff73613d92c-7ff73613d93b 985->993 994 7ff73613d943-7ff73613d94e call 7ff736137ab4 985->994 995 7ff73613d95f-7ff73613d962 986->995 996 7ff73613d964-7ff73613d973 986->996 989->977 989->990 991 7ff73613d840-7ff73613d844 990->991 992 7ff73613d7e4 990->992 991->962 997 7ff73613d7e8-7ff73613d7ff call 7ff7361440f8 992->997 993->994 994->986 995->938 995->996 996->978 1002 7ff73613d837-7ff73613d83d GetLastError 997->1002 1003 7ff73613d801-7ff73613d80d 997->1003 1002->991 1004 7ff73613d82c-7ff73613d833 1003->1004 1005 7ff73613d80f-7ff73613d821 call 7ff7361440f8 1003->1005 1004->991 1007 7ff73613d835 1004->1007 1005->1002 1009 7ff73613d823-7ff73613d82a 1005->1009 1007->997 1009->1004
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73613D67B), ref: 00007FF73613D7AC
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73613D67B), ref: 00007FF73613D837
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 953036326-0
                                                                                                                                                                                                    • Opcode ID: ce892f3ad0577fbe85eb1e21f2996ec6575781514685fa103b0a2932a89662de
                                                                                                                                                                                                    • Instruction ID: eb6d2f950411190e9cd4b5b28f4db30bde95a23499146ac41c29e587bb65e588
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ce892f3ad0577fbe85eb1e21f2996ec6575781514685fa103b0a2932a89662de
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5491D872F08651A5F750AF75AC40ABEABA0BB44B98FA45139DE0F53684DF39E441E320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613FD8C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 1010 7ff73613fd8c-7ff73613fdc8 1011 7ff73613ff7e-7ff73613ff89 call 7ff736137af8 1010->1011 1012 7ff73613fdce-7ff73613fdd7 1010->1012 1018 7ff73613ff8d-7ff73613ffa9 call 7ff73612b140 1011->1018 1012->1011 1013 7ff73613fddd-7ff73613fde6 1012->1013 1013->1011 1015 7ff73613fdec-7ff73613fdef 1013->1015 1015->1011 1017 7ff73613fdf5-7ff73613fe06 1015->1017 1020 7ff73613fe08-7ff73613fe11 call 7ff73613fd30 1017->1020 1021 7ff73613fe30-7ff73613fe34 1017->1021 1020->1011 1028 7ff73613fe17-7ff73613fe1a 1020->1028 1021->1011 1023 7ff73613fe3a-7ff73613fe3e 1021->1023 1023->1011 1025 7ff73613fe44-7ff73613fe48 1023->1025 1025->1011 1027 7ff73613fe4e-7ff73613fe5e call 7ff73613fd30 1025->1027 1033 7ff73613fe67 call 7ff7361469a4 1027->1033 1034 7ff73613fe60-7ff73613fe63 1027->1034 1028->1011 1030 7ff73613fe20-7ff73613fe23 1028->1030 1030->1011 1031 7ff73613fe29 1030->1031 1031->1021 1037 7ff73613fe6c-7ff73613fe83 call 7ff736145da8 1033->1037 1034->1033 1035 7ff73613fe65 1034->1035 1035->1033 1040 7ff73613ffaa-7ff73613ffbf call 7ff73613b034 1037->1040 1041 7ff73613fe89-7ff73613fe94 call 7ff736145dd8 1037->1041 1041->1040 1046 7ff73613fe9a-7ff73613fea5 call 7ff736145e08 1041->1046 1046->1040 1049 7ff73613feab-7ff73613ff3f 1046->1049 1050 7ff73613ff79-7ff73613ff7c 1049->1050 1051 7ff73613ff41-7ff73613ff5d 1049->1051 1050->1018 1052 7ff73613ff5f-7ff73613ff63 1051->1052 1053 7ff73613ff74-7ff73613ff77 1051->1053 1052->1053 1054 7ff73613ff65-7ff73613ff70 call 7ff7361469e8 1052->1054 1053->1018 1054->1053
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _get_daylight$_isindst
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 4170891091-0
                                                                                                                                                                                                    • Opcode ID: 2a10574a06f7e14b551fd5473a10e1d2d4e4795c43c21e26d1478dc62bdae61a
                                                                                                                                                                                                    • Instruction ID: 856a9b3177458bd44b711a237f74d751d057c3b41387302a6f532e33216d394d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a10574a06f7e14b551fd5473a10e1d2d4e4795c43c21e26d1478dc62bdae61a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 66513973F042119AFB14EF64AD45ABEE765AB01398FA00235DE1E83AE4DF3DA406D710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613582C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2780335769-0
                                                                                                                                                                                                    • Opcode ID: 28f2e42c9a1948757c0a990ef0a6bed1595d20fcefd4539903a84273569d7342
                                                                                                                                                                                                    • Instruction ID: 5704fea8ad716cea7d394d0c50aab0fa8460e5bf27fe794adf9c05a471beb901
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 28f2e42c9a1948757c0a990ef0a6bed1595d20fcefd4539903a84273569d7342
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8551C462E086419AFB11EF71E850BBEB3B1AB44B68FA04035DE4E5768DDF39D4409720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361356D8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1279662727-0
                                                                                                                                                                                                    • Opcode ID: 6bd0e1a6c43f90d358afe9fa64eae98b44fdfe94f1554b8bf2ac7ea3fb7eaa9c
                                                                                                                                                                                                    • Instruction ID: 5b94db4ea133b42248eb5065819f02fed4d9ae75e34b59034a6d82dc4a97be76
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6bd0e1a6c43f90d358afe9fa64eae98b44fdfe94f1554b8bf2ac7ea3fb7eaa9c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E741E522D1878193F711AB20A90077AB260FF94B64FA08334E65D03AD5EF6DA1E09720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127A60 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Window$Process$ConsoleCurrentShowThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 242035731-0
                                                                                                                                                                                                    • Opcode ID: 617f7776868917901d058b6b435c61cd90a377e48a0db9ee3abc0ff858253bdc
                                                                                                                                                                                                    • Instruction ID: c8adeeae1a374dea00023e8dc2094389aab62c410323fdbf3c065c72b1d4eb48
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 617f7776868917901d058b6b435c61cd90a377e48a0db9ee3abc0ff858253bdc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 72F03721A18746D2FF55BB667C4453B9371BF88791F4C1030E95E43264EE3CE0459720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612B4FC Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3058843127-0
                                                                                                                                                                                                    • Opcode ID: 6cdb3baf2bdd846262fc88e39f9422b5ea388791f3d6f479c5f5fed38b2b6ca1
                                                                                                                                                                                                    • Instruction ID: 67343f34c6cdf5306983f630bd890d20b998b28a77fe49489be8596f8c604b15
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6cdb3baf2bdd846262fc88e39f9422b5ea388791f3d6f479c5f5fed38b2b6ca1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B9314111A0C24AA2FA14BB21FD51BBB9272AF45788FC44434E50E0B2D7DE6DE444A730
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613A130 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1703294689-0
                                                                                                                                                                                                    • Opcode ID: a6e2901a0e9c66cf6b99be77a2ad141b36c22de326a93cae73898e5401ed1375
                                                                                                                                                                                                    • Instruction ID: 007a8d9213535bee01352a8c882349f16da2850d7aeafa1b8b44ef924fe634ac
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a6e2901a0e9c66cf6b99be77a2ad141b36c22de326a93cae73898e5401ed1375
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9DD09E20F08712A2FB193B717D5587F92355F58751F941438C84F47393DE6DA84D6220
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612F6EC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: 5c1dbe88655f921d30981bead6d245f39c561e529b6702e21f68847feaf946d6
                                                                                                                                                                                                    • Instruction ID: 7d3a12903ddd9b3c73fd03d7ad54417a04848d6934788d81f498a3a740e37241
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5c1dbe88655f921d30981bead6d245f39c561e529b6702e21f68847feaf946d6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8051DB21B4924AE9FA24BE26BC00E7BE292EF45BA4F944634DD6D477D5CE3CD401B720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613CB48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: FileHandleType
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3000768030-0
                                                                                                                                                                                                    • Opcode ID: c94a40f012f56c4d4bf2c28a7e1244308aaf5ec7a67ed039cf35f94c720a2e80
                                                                                                                                                                                                    • Instruction ID: fd6664691de9d2fa00959435a1e09daea12489e8970c9245de1e5f8750753764
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c94a40f012f56c4d4bf2c28a7e1244308aaf5ec7a67ed039cf35f94c720a2e80
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D5317632B18B5561FB60AB14E98057AA651E746BB0FB40725DB5F073E4CF3AE451E310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613B28C Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF73613B109,?,?,00000000,00007FF73613B1BE), ref: 00007FF73613B2FA
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FF73613B109,?,?,00000000,00007FF73613B1BE), ref: 00007FF73613B304
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1687624791-0
                                                                                                                                                                                                    • Opcode ID: 25d57b0519697dedb0d6041d0ffd926a94c3b50afaeaa4c3455fd6318eb1c41f
                                                                                                                                                                                                    • Instruction ID: 5545f95cc7ce1798426af0ac4642b745c8f10795525f1a53683c6f474cec9f36
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 25d57b0519697dedb0d6041d0ffd926a94c3b50afaeaa4c3455fd6318eb1c41f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5421D411F1868261FE90B771BE40A7FD2A25F947A0FA44334DA1F473C6EE6EE441A320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613C864 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF73613C850,?,?,?,?,00007FF736121023,00007FF73613C959), ref: 00007FF73613C8B0
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00007FF73613C850,?,?,?,?,00007FF736121023,00007FF73613C959), ref: 00007FF73613C8BA
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorFileLastPointer
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2976181284-0
                                                                                                                                                                                                    • Opcode ID: 37b35763ba551cf9947c496a64eddd6e5bca569dc91982f16a9db206e0cd36f5
                                                                                                                                                                                                    • Instruction ID: 7d08870406afc4a2efe229b4982e9394e8a0e2b633cfdd62e1856f12fe923182
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 37b35763ba551cf9947c496a64eddd6e5bca569dc91982f16a9db206e0cd36f5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1711C462B08A8191FA10AB25B80456AF361AB45BF4FA44331EE7E077D9CF7DD1519700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361359D4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7361358E9), ref: 00007FF736135A07
                                                                                                                                                                                                    • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7361358E9), ref: 00007FF736135A1D
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1707611234-0
                                                                                                                                                                                                    • Opcode ID: 282b0641613884d2da52850984616ce4d8f02467e31009fdda7c24e1208d9727
                                                                                                                                                                                                    • Instruction ID: 4fbf532c242ab9ce52b54bbb017d7d2a277adb441ad7c40d673cb07bb1d51f63
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 282b0641613884d2da52850984616ce4d8f02467e31009fdda7c24e1208d9727
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2911C47160C65292FA546B14B84193FF770EB81B71FA00236F6DE819E8EF2DD154EB20
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736138230 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7361380AD), ref: 00007FF736138253
                                                                                                                                                                                                    • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7361380AD), ref: 00007FF736138269
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1707611234-0
                                                                                                                                                                                                    • Opcode ID: c8b467848ad18cca18cf705f0de1f02f8421b76cbd5397d4b141972e62174a89
                                                                                                                                                                                                    • Instruction ID: cf0de4f5fb7336270eb5ee18af5a210d7124819892f222c34bd7b1ce8d26b215
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c8b467848ad18cca18cf705f0de1f02f8421b76cbd5397d4b141972e62174a89
                                                                                                                                                                                                    • Instruction Fuzzy Hash: EC01822251C65196F750AB25BC01A3BF3B1FB41721FA00236E6AA455D8DF7DD054EB20
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613B07C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B092
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B09C
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 588628887-0
                                                                                                                                                                                                    • Opcode ID: d24a2d06a7c5f2e99e63c944d13c289627c19e2dfcbd9b18694a327a8aaf0a58
                                                                                                                                                                                                    • Instruction ID: c5cff3ecdd6e72a8393d38dcb40243e0034f04ccb3118321e8204f9c22241bff
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d24a2d06a7c5f2e99e63c944d13c289627c19e2dfcbd9b18694a327a8aaf0a58
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 68E08651F0810263FF55BBB17C4983BA1705F64B40FD40034CC1E87261EE2CA8857730
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736137F98 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 377330604-0
                                                                                                                                                                                                    • Opcode ID: 8161766eeee1115980fa8ee10532470a3df7ba21b71be4d7cb7071516e934bd4
                                                                                                                                                                                                    • Instruction ID: 761ce3d29da22250efa3776204db5c62890b29e11980081b73fc25ede06bc716
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8161766eeee1115980fa8ee10532470a3df7ba21b71be4d7cb7071516e934bd4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A4D0C911F18513A2F61537763C4987BA0B46F94720FE00630C02A822D1ED1DB5852935
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613881C Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeleteErrorFileLast
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2018770650-0
                                                                                                                                                                                                    • Opcode ID: 1cf422e75b369def8a20cc9a0179700f98c5337194a78ac4e322daaad6999dfd
                                                                                                                                                                                                    • Instruction ID: 7bc30ca2d220045cb8e44faae1791d3fcb3dfb15164142f0e6aee926571cf1c6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1cf422e75b369def8a20cc9a0179700f98c5337194a78ac4e322daaad6999dfd
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8DD0C914F18502A2FA5437713C4583BA1B02F94760FE00670C01B812E0ED9DA1857521
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736126EF0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2772937645-0
                                                                                                                                                                                                    • Opcode ID: 4c9522810f705bbf71acb3bcac6c0f5b98fb1b309dac4e99a8a4d1c63cb37057
                                                                                                                                                                                                    • Instruction ID: 40ec606e9b4aa9f31418dfc6ad8fd1484e70de1817124423933eb5885b6e54cb
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4c9522810f705bbf71acb3bcac6c0f5b98fb1b309dac4e99a8a4d1c63cb37057
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F5718453E18AC591E611DB2CD9052FEA370F7A9B4CF94E321DB9C12592EF28E2D9C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613C5DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: f6dbf763e6c017c42731e6f3c0b6023bdc46bbdf128b1aaddc67f6708a105885
                                                                                                                                                                                                    • Instruction ID: e8387999e457d9afd858f3f563036477ab7c9d94971caddc6166b8adc110ed8a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f6dbf763e6c017c42731e6f3c0b6023bdc46bbdf128b1aaddc67f6708a105885
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2E41E972A0828197FA34AB19B94057AF7A1EB56B50FB01131DA8F877D0CF2EE402D760
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127460 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _fread_nolock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 840049012-0
                                                                                                                                                                                                    • Opcode ID: 7f77f2da601fc2d17187cc0079bd122bbe65b642a14edd55c5b8d286f220f3e3
                                                                                                                                                                                                    • Instruction ID: b0056ae6f4cad9a6f9aa31c0e865acbcbbdb5ef0262fb2a5371269cc6dcf7140
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7f77f2da601fc2d17187cc0079bd122bbe65b642a14edd55c5b8d286f220f3e3
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0B218222B08396A9FA15BA127D08BBBE662BF45BD4FC84430EE0D07786CE3DE141D210
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613C06C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: e620e18049c4adad5ea9372f23144baec0a1cce946fd766f32c2a126b5610598
                                                                                                                                                                                                    • Instruction ID: 7ad11508380db5e9b383a79696a5835e015b51c16c999e490093a6628ac90518
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e620e18049c4adad5ea9372f23144baec0a1cce946fd766f32c2a126b5610598
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5331C062A18642A2F7107B15AC44B7EB650AB41BA0FE50235D91E433E2CFBEE441B734
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613A061 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3947729631-0
                                                                                                                                                                                                    • Opcode ID: 5e6915d59ae941ac211a12e52a8b433118b883046245a70c022b21b51ed9ed3c
                                                                                                                                                                                                    • Instruction ID: ab118831f1839c8bfc4216992feb1700833b9eedfd2674fc64e047c13e21594e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5e6915d59ae941ac211a12e52a8b433118b883046245a70c022b21b51ed9ed3c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D121DE32E047469AFB20AF64E840AED73B0FB04718FA00635D71E46AC5DFB9D444E7A0
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361365A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: 7624878a2af1481d619e4a3cb70b54330390797c8d08e01795187638a596a408
                                                                                                                                                                                                    • Instruction ID: 4f5eb0630ef53ec366d9054688a20f54b845c3305b128b0a62b7efc073810c12
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7624878a2af1481d619e4a3cb70b54330390797c8d08e01795187638a596a408
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6811C621A1C24191FAA0BF01BC0097FE260BF85BC0FE84031EA4F5769ADF7ED4106764
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736146D4C Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: 3055e617bc580fa52ed7fef649b6049a9337a7b25e36212d0b35c7f46fbb56c7
                                                                                                                                                                                                    • Instruction ID: 41facff910b3b9817f0e0fc27acbd70a5bd4654fec81568f314725198e617d47
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3055e617bc580fa52ed7fef649b6049a9337a7b25e36212d0b35c7f46fbb56c7
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B210A3361868197F761AF18FC8077AB2B0EB84B58FA44234DA9E472D5EF3DD4109B50
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612F96C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: b461025820c8ee2d6c16fb7c608a010fca81ce70ecce8d095689b96e7b39b2a0
                                                                                                                                                                                                    • Instruction ID: ac49b86b31ac14ccbc10a6b3a1e288df189f71faa584a6e3ea534955e4934ef1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b461025820c8ee2d6c16fb7c608a010fca81ce70ecce8d095689b96e7b39b2a0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1C010C21A0874594F904FF126C0056BE692BF45FE0F984531EE5C137D5CE3DD0116710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613F2E0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF73613BB16,?,?,?,00007FF73613ACD7,?,?,00000000,00007FF73613AF72), ref: 00007FF73613F335
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1279760036-0
                                                                                                                                                                                                    • Opcode ID: 080bedd330cc5f3cd245cee93f9acbec12b0592ad13e0ddfdb5ba44fcf704501
                                                                                                                                                                                                    • Instruction ID: 76213a696c7bf55bd0fb704f40f36b8c60f592634cde801fd0e065998bc85596
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 080bedd330cc5f3cd245cee93f9acbec12b0592ad13e0ddfdb5ba44fcf704501
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D5F06D18B0D207A9FE95B666BC45BBB92941F44B80FEC4030C90F962D1EE1DE480A231
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613DD2C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(?,?,?,00007FF7361301D4,?,?,?,00007FF7361316E6,?,?,?,?,?,00007FF73613374D), ref: 00007FF73613DD6A
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1279760036-0
                                                                                                                                                                                                    • Opcode ID: 73a40e3f3a85e091f80b04137003e3a7afc43011a137b4599572fbd139c6e91e
                                                                                                                                                                                                    • Instruction ID: 418fd8430a2d42d8d11e21204d4aa576c882f1919e59a74b2c9c0982d02923e8
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 73a40e3f3a85e091f80b04137003e3a7afc43011a137b4599572fbd139c6e91e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 56F05E51F0C24365FA553A727C45E77A2A04F447A0FE90630DD2F462D1DE1DA440BA30
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127590 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 377330604-0
                                                                                                                                                                                                    • Opcode ID: eedd41578a6acdf9acd5e442cd5d3efce21e5407d28b277ecefe638e2ddc1258
                                                                                                                                                                                                    • Instruction ID: 2ac9809ed9a2c490ac986b34e0e6e5c4aa69567f5d8003ed1f0c743d27574a79
                                                                                                                                                                                                    • Opcode Fuzzy Hash: eedd41578a6acdf9acd5e442cd5d3efce21e5407d28b277ecefe638e2ddc1258
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BA41B417D1C6C9D2F651AB28A9456BFA371FBA5744F849232DB8D42183EF2CA1C8D320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                                    Function 00007FF7361260A0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                                                                    • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                    • API String ID: 190572456-2208601799
                                                                                                                                                                                                    • Opcode ID: 5463ccdcb7bff7281cbab3524ba9f70acb137e12f5492aac9757fb017ff5909f
                                                                                                                                                                                                    • Instruction ID: d94150f19536df7ca254b484648696c217195a093344c49a9022e3a477e3cd4c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5463ccdcb7bff7281cbab3524ba9f70acb137e12f5492aac9757fb017ff5909f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A6E1D660E1AB27F1FE16AB08FC54977A3B2AF04780BC56135C80E472A4FF6CA454B364
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361447BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                    • API String ID: 808467561-2761157908
                                                                                                                                                                                                    • Opcode ID: 5350d0954fd260507cf9022c11a5ef442575f550d5e4285e85a8c1e7e951d3da
                                                                                                                                                                                                    • Instruction ID: 5ffcb676ae9d0072e9ad733a8a4e09c32181d3b074c6c1a676840511839f98dd
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5350d0954fd260507cf9022c11a5ef442575f550d5e4285e85a8c1e7e951d3da
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 53B2FA72A182A29BF7269F64E840FFEB7B1FB54344F905135D60D57A88EF38A500EB50
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127770 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetLastError.KERNEL32(WideCharToMultiByte,00007FF736122044,?,?,00000000,00007FF736127A02), ref: 00007FF736127797
                                                                                                                                                                                                    • FormatMessageW.KERNEL32 ref: 00007FF7361277C6
                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32 ref: 00007FF73612781C
                                                                                                                                                                                                      • Part of subcall function 00007FF736122010: GetLastError.KERNEL32(?,?,00000000,00007FF736127A02,?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF736122037
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                                                                                                                                                    • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                    • API String ID: 2383786077-2573406579
                                                                                                                                                                                                    • Opcode ID: 04ee3cd00207850dd2e6a2071cc5d284662f4cf938f5c9183aad39119c3df669
                                                                                                                                                                                                    • Instruction ID: 9fe105529cb3ca78a96ba5a87bf1faf1e816ea5917098476633bc2c0d478abc5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 04ee3cd00207850dd2e6a2071cc5d284662f4cf938f5c9183aad39119c3df669
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5D216071B08A46E1FB61AB15FC64A6BA2B6FB48344FC04039D64D836A4EF3CD105E720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612BA0C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3140674995-0
                                                                                                                                                                                                    • Opcode ID: 37ff5448d43a2818f8c0d128425b2ce538f04ef771ee94377d257e9384cb20a9
                                                                                                                                                                                                    • Instruction ID: 5078071b4ef547ac8c8ebec7c4b67a627f9b40de46ee63eb77d7a90a6f07e926
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 37ff5448d43a2818f8c0d128425b2ce538f04ef771ee94377d257e9384cb20a9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B9316F72609A859AFB60AF60F8807EBB371FB44748F844439DA4D47A98EF3CC148D720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613AD48 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1239891234-0
                                                                                                                                                                                                    • Opcode ID: 66808e784aa5cfe9c560ec4eeba8f7493aa31f40de6b99df361909bc67b99368
                                                                                                                                                                                                    • Instruction ID: 537d9504d0c6a26f538c4b6c5b6342b2727a79da804a520733460538f6bba50d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 66808e784aa5cfe9c560ec4eeba8f7493aa31f40de6b99df361909bc67b99368
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6E317E32608B8196EB609F25FC446AFB3B4FB88754F940135EA8D43B58EF3CC1458B10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736141F84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2227656907-0
                                                                                                                                                                                                    • Opcode ID: ed9b9a45754c297c9266a6c056c6629c49092092c138a59ec059538714f4b342
                                                                                                                                                                                                    • Instruction ID: 75395d41c387931306e8f99800eabac7bf535e495b6e4895754c51918d812002
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ed9b9a45754c297c9266a6c056c6629c49092092c138a59ec059538714f4b342
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9AB1D821B186A251FA62EB61BD00ABBE371EB54BD4F944131EE5E47B84FE3CE481D314
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612B8F0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2933794660-0
                                                                                                                                                                                                    • Opcode ID: 4e955580a84fde3e70d22fecd0f2b393210789ba5e00c7a52904b47aa3fa2431
                                                                                                                                                                                                    • Instruction ID: 0e64d027af1c43f9af77158d7ab917231d42d106ffb1210086bdd4f0ada2dc72
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4e955580a84fde3e70d22fecd0f2b393210789ba5e00c7a52904b47aa3fa2431
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CB118C22B14B059AFB00DF60FC446AA73B4FB18B18F800E31DA2D877A4EF38D1949390
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736144320 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: memcpy_s
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1502251526-0
                                                                                                                                                                                                    • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                    • Instruction ID: f901cd252a9c8b17fcdae3bcaffa34b3fce2dadc65fba9cd1e0ccb4fe4f9198c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0DC11372B1C29687EB25DF19B444A6AF7A1F785B84F848134DB4E43784EA3CE801EB10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73614A098 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 15204871-0
                                                                                                                                                                                                    • Opcode ID: 6086eb93117cbdd40dcce80d0f320cf3c25414694c06e5072162cfc18cb5e03b
                                                                                                                                                                                                    • Instruction ID: 583c5b0493a3a7c7b843df820be00913b272bd89137c820aca9e728bcda79711
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6086eb93117cbdd40dcce80d0f320cf3c25414694c06e5072162cfc18cb5e03b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 03B1BA73600B988BEB16CF29D842769BBB0F744B88F0A8821DB5D837A8DB79D451D710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736133A08 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: $
                                                                                                                                                                                                    • API String ID: 0-227171996
                                                                                                                                                                                                    • Opcode ID: 8a2244f9f01d008a31bb46367ccdf16fe5475683a9ba68cfcd60f97e58280a0d
                                                                                                                                                                                                    • Instruction ID: 1ab9a763412aa32a94e3231b209ecf7523b2684436c9ea696e3348b593182db3
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8a2244f9f01d008a31bb46367ccdf16fe5475683a9ba68cfcd60f97e58280a0d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E4E1EB3290868692FB68AE15A85093FB3A0FF45B54FB84235DA4F47794DF3BD841E324
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613E620 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: e+000$gfff
                                                                                                                                                                                                    • API String ID: 0-3030954782
                                                                                                                                                                                                    • Opcode ID: 8987ca567417131813b7b9ceac4c5f721eef363b4a4c5c85197565331751bcb3
                                                                                                                                                                                                    • Instruction ID: f424be18ef45cedc8dda46ead04930e7ba9c17fa98678c2cf0c2fb3ce7d17524
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8987ca567417131813b7b9ceac4c5f721eef363b4a4c5c85197565331751bcb3
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 27516A62B183C596F7309A35AD00B6AEB91E784B94F988232CB5D47AC6DE3ED0049710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736140FD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1010374628-0
                                                                                                                                                                                                    • Opcode ID: abf00f89db48240a9ebee6f6f1361a0f52222d3f71a775090f4208c12a5e0fd6
                                                                                                                                                                                                    • Instruction ID: 40c12647fb175aa4248dec18bcdeb60e00779590796e6dab36bf014ff28d5471
                                                                                                                                                                                                    • Opcode Fuzzy Hash: abf00f89db48240a9ebee6f6f1361a0f52222d3f71a775090f4208c12a5e0fd6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6102B721B09753A0FA92BB26BD02A7BDAB46F05B90FD44534DD6E477D1EE3DE401A320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613E18C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: gfffffff
                                                                                                                                                                                                    • API String ID: 0-1523873471
                                                                                                                                                                                                    • Opcode ID: 044ea01a83f21d979267e64e7a342dc4f700b025a7de61dccab693e18f3731af
                                                                                                                                                                                                    • Instruction ID: 04caf36d9d2ae8aed8c44d41c36a249601b5398921d407d13f88ae944e2b6643
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 044ea01a83f21d979267e64e7a342dc4f700b025a7de61dccab693e18f3731af
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3EA15963A087C696FB31DF25B800BAEBB91AB54784F648032DE4E47791DE3EE801D711
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736138844 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: TMP
                                                                                                                                                                                                    • API String ID: 3215553584-3125297090
                                                                                                                                                                                                    • Opcode ID: 282ed346ca4bcea605185949eb897bf82329db27ea8c32693051aec46bcd710f
                                                                                                                                                                                                    • Instruction ID: 7065330903174b7ec8d5e6308d9f770f1fe14bb984e366cf86521977f0ffd55a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 282ed346ca4bcea605185949eb897bf82329db27ea8c32693051aec46bcd710f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CF519051B0825261FAA4BB267D0197BD6A06F84BC4FE84034DE1F477D5EE7EE402A224
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736143B90 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: HeapProcess
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 54951025-0
                                                                                                                                                                                                    • Opcode ID: 783e6ae306ca868776b93a8a6587ebb194fffd8d6c9bd8ffb97c952b5e65fa47
                                                                                                                                                                                                    • Instruction ID: a85b84cb1399beedcd4d658827966faaff2d6c6833ff552dd83c1830c24324d4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 783e6ae306ca868776b93a8a6587ebb194fffd8d6c9bd8ffb97c952b5e65fa47
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B5B09228E0BB02D3FB897B267C82A1662B47F58B00FD80038C44C41320EE2C20E57720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361331CC Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 5e7df00303cff479136cbafffd186c42f362f30798231601aab59b67f909287f
                                                                                                                                                                                                    • Instruction ID: 92fc70d1b70fab233eb55f033c952ef5343983d0320cd0dd88c2be06c3ced83e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5e7df00303cff479136cbafffd186c42f362f30798231601aab59b67f909287f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 80E11B32A086C255F765AA28E954B7EA791EB45B54FBC8231CE0F072D4CF3BD841E364
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736133604 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 0a3b222fdff026806f1e255e1c007346d9d771c0f3e9ab69586a63cc19297da5
                                                                                                                                                                                                    • Instruction ID: dbedc2220233ac2050546bd6c8c492fdafe905163c9d17356fc4aff127ee5394
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0a3b222fdff026806f1e255e1c007346d9d771c0f3e9ab69586a63cc19297da5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 87D1F962A08682D5FB689E25A804A3FA7A0EB05B48FB80235CD4F477D5CF3AD445E724
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736128450 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: e579d8aa418031001bfde45a2c39677a4aae80938621b52d82c170978b022bb8
                                                                                                                                                                                                    • Instruction ID: e5b1cf364074ae1a82078ea6825b7f1acca73789340cf58e9f0bb38a16cf2fe9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e579d8aa418031001bfde45a2c39677a4aae80938621b52d82c170978b022bb8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6CC16F732145E08BE699EB29FC5947A77A2F7C8349FD4403AEB8747785CA3CA414E720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613231C Relevance: .2, Instructions: 250COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 393d84bca425233f0110bc90ff111237c8a1d117f4c678da321c026ee5ebd95e
                                                                                                                                                                                                    • Instruction ID: 2217656c05d351f6e6dbcae4012cd218b2567f39228f9495f0e0249af86ef047
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 393d84bca425233f0110bc90ff111237c8a1d117f4c678da321c026ee5ebd95e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F4B1A27290868195FB64AF29E85067EFBA0EB05B48F744135CE4E47399CF3AE440E768
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361326B4 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 2ffdd26dc295e54b24b5e633a3cc8da5e90cf9270773a68d128a76bf2010b193
                                                                                                                                                                                                    • Instruction ID: ac9c4221b364cc271b167e453b672cb0bc94192d715f723ddeb39b40d3c00bc3
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2ffdd26dc295e54b24b5e633a3cc8da5e90cf9270773a68d128a76bf2010b193
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CEB1BD72A0879196F764AF29E85063EFBA0F705B48FB80135CA4E43395CF3AD441E768
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613ECA0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 03708c4a9679bea153bd6d20fc70f3113d59fe7e2f9b7b2b3b4246af7d946d19
                                                                                                                                                                                                    • Instruction ID: cf04b9a03d0ad4dd5751cb4f64286d2f909d11548e4bed5510d63e4f4cce8b52
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 03708c4a9679bea153bd6d20fc70f3113d59fe7e2f9b7b2b3b4246af7d946d19
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C681E672A0C78196FB74DB19B84077BAA91FB85794FA04236DA9E43B85CF3ED4009B10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736146E10 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                                                    • Opcode ID: 9f579515903afe2fe359d847c0abb44dcbb5d2485945af27c96d8450a1696fdf
                                                                                                                                                                                                    • Instruction ID: bc30fbda579fd32ec8045fed9cb16273e827ce125ecdc44246e522c4fec29fb5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9f579515903afe2fe359d847c0abb44dcbb5d2485945af27c96d8450a1696fdf
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E4614E22F1D27261F726AA28EC64F3BE5A0AF41764F940235D65D836C1FE7EE8006760
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736131754 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 36cfbc186101e0a77f1890a1c7e808c8c6087910b00f1974ef122b20eb5bde20
                                                                                                                                                                                                    • Instruction ID: 9231005d68e2992adc46924ee329006f7419bf4f0c51122e1d46c70ed1f10023
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 36cfbc186101e0a77f1890a1c7e808c8c6087910b00f1974ef122b20eb5bde20
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E5510937A1865192F7A49B29E44163A7BA0EB48B58F784131CE4E17794CF3BE843E750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736130F34 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: c8186251b5f2d9343d3d72692f21d58eaac1bc924a39335db57a069b4ce12c81
                                                                                                                                                                                                    • Instruction ID: a78f006c6d49833a444fb7421ec97eb55f9684862bc01bce8ed3381151ec41c7
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c8186251b5f2d9343d3d72692f21d58eaac1bc924a39335db57a069b4ce12c81
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BB510632A18A5192F7649B29E441A3AB7B0EB44B68F744131CE8E477D4CB3BEC53D790
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736131344 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 245e9c4bc0e0b9f18a3364aab59be83cbd96958e997944c25b022b0bfdd10beb
                                                                                                                                                                                                    • Instruction ID: 30bee22c1fa893dfad3918f0f81ec7c973a7fe9e2de7c1010b96020b582e0d70
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 245e9c4bc0e0b9f18a3364aab59be83cbd96958e997944c25b022b0bfdd10beb
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8651D632A1865192F7A4DB29E441A3ABBA0EB49B6CF744131CE4E07794CB3BE843D750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736131550 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: a877b357e31cd599e68a74dbaf5c8661608319cea2a418fc02a8a2ced54dbdec
                                                                                                                                                                                                    • Instruction ID: 281788792ae518b7d0d8e8871c9bdfe52f313251bec33c31e34c16b737ac05ec
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a877b357e31cd599e68a74dbaf5c8661608319cea2a418fc02a8a2ced54dbdec
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E3511576A1865192F7A49B28E401A3ABBA0EB45B58F784131CE4F07394CF3BE843D750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736130D30 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 0b95b690bf34b7a50a36fd66378ab931284c1144445f06a5a46fd3f94635bebb
                                                                                                                                                                                                    • Instruction ID: 94ae9fc5d124e4f04ec243ab16930331e226542cdb96aa33c47096f08ae61c6d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0b95b690bf34b7a50a36fd66378ab931284c1144445f06a5a46fd3f94635bebb
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9951B232A1865196F7649B29E440B3AB7E0EB48F59FB44131CECE17794CB3BE882D750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736131140 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 9412276bc5eb2fa85696182c8cfd52c2e9645a9302085a3d80f1ecd3ea1c0082
                                                                                                                                                                                                    • Instruction ID: 65fb51f8423cb1b7f198294f02441e191cada30dafd47a79016e584e23ec0cdf
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9412276bc5eb2fa85696182c8cfd52c2e9645a9302085a3d80f1ecd3ea1c0082
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 47514332A1864191F7A49B39E801A7ABBB1EB55B58FB44130CE4E03794CB3BE853D750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736136030 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                                                                    • Instruction ID: 6894ed721cdf0675ba0e31aaa77bee09a3bc919a90c1bd6e1089745e2dad744f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F2413A62C3974A14FDE199181E01FBA9A909F53BA0DF812B4CD9F5B3C7CD0F25BA9160
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613A5A0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 588628887-0
                                                                                                                                                                                                    • Opcode ID: 59be43eb8d076d01d402444045cd33edadaf25ce51fc1d4ab9771e793c509044
                                                                                                                                                                                                    • Instruction ID: 16f36e22abded7dbea3a1f9eb1176dec0a89c92443282dd549bb4d285c0b6fe5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 59be43eb8d076d01d402444045cd33edadaf25ce51fc1d4ab9771e793c509044
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B4126B2B14A5492FF18DF2AED1496AF3A1AB48FD0B999033DE0D87B58DE3DC0419310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736137E0C Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 16ba028e5140cb669141a543d818c4ae00c90cc79f364a657821b0498d7d1038
                                                                                                                                                                                                    • Instruction ID: 322729e15e334c08a64393112aaa180df7bd010f170b7c22d98f42933c95f4f4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 16ba028e5140cb669141a543d818c4ae00c90cc79f364a657821b0498d7d1038
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2631C332708B4281F764AB267C4457FA695AB84B90F644238EA5E53BD5DF3CD401A718
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736149EE0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 009e600705636fd16fabd64e4544822c4a85a16534b4f864f5eae51caed44aa6
                                                                                                                                                                                                    • Instruction ID: d43f77c837e74a4f816fde58265e04c9bf2c261e5c55ece486e47e0983583e45
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 009e600705636fd16fabd64e4544822c4a85a16534b4f864f5eae51caed44aa6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B5F044757182559AEB94DF2DB803A2A7BE0E718391B808479E58983E04D63C90609F14
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612BBB4 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: ca0e6f9b860d2c98b078fa5f57a083f61e3f9e605b4d53a6314ede26f7eaa120
                                                                                                                                                                                                    • Instruction ID: 9f743c1271881896a9942a80e2f2fc05401750dbe1ea35cca4fffb5bbfc01866
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ca0e6f9b860d2c98b078fa5f57a083f61e3f9e605b4d53a6314ede26f7eaa120
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2DA0012590881AE0F645AB50BCA8823A331BB50704BC44031D00D421A4AE2CA400A221
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736124360 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                                                                    • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                    • API String ID: 190572456-4266016200
                                                                                                                                                                                                    • Opcode ID: 9ee41e508b04c4f76b3c5f7088caadaf40c48e2903053b1ba22dbe159ca28081
                                                                                                                                                                                                    • Instruction ID: 6dea6f2465ddd2b6612cd978d629e5783c6731cb1a118789a075c35ed41abf5d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9ee41e508b04c4f76b3c5f7088caadaf40c48e2903053b1ba22dbe159ca28081
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9B12A964A0AB27F0FA26EB08FC54977E2B5AF45791BC46435C90E47264FF7CA548B230
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127DA0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 114COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32 ref: 00007FF736127DDC
                                                                                                                                                                                                      • Part of subcall function 00007FF736122010: GetLastError.KERNEL32(?,?,00000000,00007FF736127A02,?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF736122037
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                    • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                                                                                                                                                    • API String ID: 203985260-1562484376
                                                                                                                                                                                                    • Opcode ID: 0c6cca92c96898192c7e44d3947d30de971cdba8f90ca0e9696e434fe2c8ddc5
                                                                                                                                                                                                    • Instruction ID: e02b0ddcae0c8d0fa5092eaf8e5e6f8ebb987b3757a9dac2737be6d871f204fb
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0c6cca92c96898192c7e44d3947d30de971cdba8f90ca0e9696e434fe2c8ddc5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DB41B272A0C647A1FB11BB22BC5097BE2B2AF44BD0FD44534E94E47A95EF3CE101A720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361212B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _fread_nolock
                                                                                                                                                                                                    • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                                                                                                                                                                                    • API String ID: 840049012-2316137593
                                                                                                                                                                                                    • Opcode ID: 5d0193abe54e123c0cb7ee968fc88856ea447d9f7101b1c647ed853240335e1d
                                                                                                                                                                                                    • Instruction ID: 1921d449b1b6eeddb42973fc89efef6f2a9c9a91803e5cc1971356cbb6ff8d2c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5d0193abe54e123c0cb7ee968fc88856ea447d9f7101b1c647ed853240335e1d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C851C461A0868BA6FA61F711BC51AFBA762EF007C4FD04031EE4D47B85EE3CE545A310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361368A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: -$:$f$p$p
                                                                                                                                                                                                    • API String ID: 3215553584-2013873522
                                                                                                                                                                                                    • Opcode ID: c059558fe464aa6bbb9f2b7f26af60ff966496dff36e614857b5e58a2c5b2e0d
                                                                                                                                                                                                    • Instruction ID: e6fb61ebf75012804e8c4356f51f75d12ab6b177d0b8ba2d3d08f9407592a7c6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c059558fe464aa6bbb9f2b7f26af60ff966496dff36e614857b5e58a2c5b2e0d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6612E922E2C24356FFA0BA15F854A7BF661EB40750FE44031E68B475C4DF3EE464ABA4
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361305B8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: f$f$p$p$f
                                                                                                                                                                                                    • API String ID: 3215553584-1325933183
                                                                                                                                                                                                    • Opcode ID: c0a981aa494adbb3b7342c3752dce4118702a1c34e2079eb9dc52d78b32a8c41
                                                                                                                                                                                                    • Instruction ID: 27432f36ffb1ddf33a683b239738228fca4b96507314fbcb1d772bbb260ecdff
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c0a981aa494adbb3b7342c3752dce4118702a1c34e2079eb9dc52d78b32a8c41
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D5128226E0C143A6FB20AE15B854B7BF6E1EB40755FE44031D6DB466C4DB7EE980AB20
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361215A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                    • API String ID: 0-3659356012
                                                                                                                                                                                                    • Opcode ID: 31c408f03ea9c201db52a40c96de260b1352882a007ba7f67863b1e821d8b495
                                                                                                                                                                                                    • Instruction ID: 540dc6f2ef8e8abeeb2b61ed18090204fb42bbc15d88855b838b425917097cfb
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 31c408f03ea9c201db52a40c96de260b1352882a007ba7f67863b1e821d8b495
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C631BD21B08686A6FA65FB11BC419BBE762EF047C4FC84032DF4D07A95EE7CE505A320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612DF70 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                    • String ID: csm$csm$csm
                                                                                                                                                                                                    • API String ID: 849930591-393685449
                                                                                                                                                                                                    • Opcode ID: f2cf64710e38112f51e0a22c12fbfd752421577326e0247822af47d2654baa19
                                                                                                                                                                                                    • Instruction ID: 1fe97c0306268e954b51c0c4007c507e0cdba6f9c0b2fa3f0cecb987aeec8a18
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f2cf64710e38112f51e0a22c12fbfd752421577326e0247822af47d2654baa19
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 23E19272A08749DAFB20EF65E840AAEB7A1FB48788F900135DE4D47B55CF38E081D750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361278C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF736127957
                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF7361279AE
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ByteCharMultiWide
                                                                                                                                                                                                    • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                    • API String ID: 626452242-27947307
                                                                                                                                                                                                    • Opcode ID: 85a79f417e6575e2afc23091c2ab10475e4b7cebdf1d517f3ba6886a492d79b0
                                                                                                                                                                                                    • Instruction ID: 86f0d6a9f8c04b4d6085f28d63046bc34c444b74643acd64371aa1f10a6abef9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 85a79f417e6575e2afc23091c2ab10475e4b7cebdf1d517f3ba6886a492d79b0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 74417E32A08B9692EA21EF15BC4096BF6B2FB447A0F944135DA8D43B98EF7CD055E710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736128070 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00007FF7361230A5), ref: 00007FF7361280B1
                                                                                                                                                                                                      • Part of subcall function 00007FF736122010: GetLastError.KERNEL32(?,?,00000000,00007FF736127A02,?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF736122037
                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00007FF7361230A5), ref: 00007FF736128125
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                    • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                    • API String ID: 1717984340-27947307
                                                                                                                                                                                                    • Opcode ID: 7e4b7d797738660c49ae4faf498e27db6c93f9a5a5df5a731612ffcf728d2707
                                                                                                                                                                                                    • Instruction ID: 45a7e28053d3d8135251e71ff6e28ca62e5895dd6d026732e69509b8258af54c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7e4b7d797738660c49ae4faf498e27db6c93f9a5a5df5a731612ffcf728d2707
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3C218D30B08B4AA5FA51AF16BC5096AB372BB44B80B944135CA5D837A4EFBCE445E314
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736126750 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo$_fread_nolock
                                                                                                                                                                                                    • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                                                                                                                                                    • API String ID: 3231891352-3501660386
                                                                                                                                                                                                    • Opcode ID: 2c88bc1dcb7f0244c47e430fec270f33f6d6d92bad1dea5d22751f8d268da602
                                                                                                                                                                                                    • Instruction ID: 2ad1b05c3f233865ade7ca4285cd054b980da3b0f96f72b36ffa2d7aa7ae16b1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2c88bc1dcb7f0244c47e430fec270f33f6d6d92bad1dea5d22751f8d268da602
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D1518160E1C246E6FE51BB15FD40ABBD2A29F457C0FC44131EA4D876DAEE2CE514B3A0
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361265D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                      • Part of subcall function 00007FF736127F60: MultiByteToWideChar.KERNEL32 ref: 00007FF736127F9A
                                                                                                                                                                                                    • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF736126B51,00000000,00000000,00000000,00000000,?,00007FF73612154F), ref: 00007FF73612662F
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF73612668A
                                                                                                                                                                                                    • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF736126606
                                                                                                                                                                                                    • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF736126643
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                                                                    • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                    • API String ID: 2001182103-3498232454
                                                                                                                                                                                                    • Opcode ID: fddc7fbdde69bc4d9ca39ee469a534e04895065dd2bd8e4cad5e769966e386b1
                                                                                                                                                                                                    • Instruction ID: 38ba115fca0862d2f2c506bb6b189bb76e489878e7b159dca88bc9fb41c9a2c6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fddc7fbdde69bc4d9ca39ee469a534e04895065dd2bd8e4cad5e769966e386b1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D8319551B18786A1FA61B721FD55ABBD262AF987C0FC40431DA0E437D6FE2CE104A660
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612D228 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF73612D4DA,?,?,?,00007FF73612D1CC,?,?,00000001,00007FF73612CDE9), ref: 00007FF73612D2AD
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FF73612D4DA,?,?,?,00007FF73612D1CC,?,?,00000001,00007FF73612CDE9), ref: 00007FF73612D2BB
                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF73612D4DA,?,?,?,00007FF73612D1CC,?,?,00000001,00007FF73612CDE9), ref: 00007FF73612D2E5
                                                                                                                                                                                                    • FreeLibrary.KERNEL32(?,?,?,00007FF73612D4DA,?,?,?,00007FF73612D1CC,?,?,00000001,00007FF73612CDE9), ref: 00007FF73612D32B
                                                                                                                                                                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF73612D4DA,?,?,?,00007FF73612D1CC,?,?,00000001,00007FF73612CDE9), ref: 00007FF73612D337
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                    • String ID: api-ms-
                                                                                                                                                                                                    • API String ID: 2559590344-2084034818
                                                                                                                                                                                                    • Opcode ID: a73e667a50778dc33a05b196f91a30174023db5b8b5356bbfce1b6ccabe42e37
                                                                                                                                                                                                    • Instruction ID: 41a3310e7c60e6a3e636e991606012e68ab2092be862eec1064de1c5460f1a7e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a73e667a50778dc33a05b196f91a30174023db5b8b5356bbfce1b6ccabe42e37
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 55319261A0A606E5FE12EB12FD0097BA3A5BF48BA0F990534DD1D47380EF3CE0409324
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127F60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32 ref: 00007FF736127F9A
                                                                                                                                                                                                      • Part of subcall function 00007FF736122010: GetLastError.KERNEL32(?,?,00000000,00007FF736127A02,?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF736122037
                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32 ref: 00007FF736128020
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                    • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                    • API String ID: 1717984340-876015163
                                                                                                                                                                                                    • Opcode ID: 5f5e2881999e0f283ab7c14dc4178b35178e445cb5ad899db9d739c101dcd3eb
                                                                                                                                                                                                    • Instruction ID: 44d89ec434b513d21535fce8174fb35ceaede7640fc28e798729387c043a692b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5f5e2881999e0f283ab7c14dc4178b35178e445cb5ad899db9d739c101dcd3eb
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4F21A021B08A5691FB51EB29FC0056BE3B2EF887D4B984135DB4C83BA9EF2CE541D714
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613B880 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Value$ErrorLast
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2506987500-0
                                                                                                                                                                                                    • Opcode ID: ac8213b9175a2c433492c501229c064464593cf5a036def36afbf01699dd0c7b
                                                                                                                                                                                                    • Instruction ID: 29df64c37c974d7e5dee7ee1ae0a1381374ae332e14b1638675d061f6b2421ad
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ac8213b9175a2c433492c501229c064464593cf5a036def36afbf01699dd0c7b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 49217FA0F0C24666FA64B7257D51C3BD2715F647B0FA44634D93F07AD6EE2EA4006320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73614865C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                    • String ID: CONOUT$
                                                                                                                                                                                                    • API String ID: 3230265001-3130406586
                                                                                                                                                                                                    • Opcode ID: 8e7c4a83e848ffa362a64a345b4e1b8a5f048e7259c9c2941a15b6fcf777327e
                                                                                                                                                                                                    • Instruction ID: 3d9997a97168d3333a38c436a4f9e085a9f27adc581b6f31230175088d81aee1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8e7c4a83e848ffa362a64a345b4e1b8a5f048e7259c9c2941a15b6fcf777327e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9B116D61B18B6196F351AB16BC54B2AE2B0FB88BA5F804234DA2D877A4DF7CD4048754
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613B9F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FF736137B01,?,?,?,?,00007FF73613F347,?,?,00000000,00007FF73613BB16,?,?,?), ref: 00007FF73613BA07
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF736137B01,?,?,?,?,00007FF73613F347,?,?,00000000,00007FF73613BB16,?,?,?), ref: 00007FF73613BA3D
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF736137B01,?,?,?,?,00007FF73613F347,?,?,00000000,00007FF73613BB16,?,?,?), ref: 00007FF73613BA6A
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF736137B01,?,?,?,?,00007FF73613F347,?,?,00000000,00007FF73613BB16,?,?,?), ref: 00007FF73613BA7B
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF736137B01,?,?,?,?,00007FF73613F347,?,?,00000000,00007FF73613BB16,?,?,?), ref: 00007FF73613BA8C
                                                                                                                                                                                                    • SetLastError.KERNEL32(?,?,?,00007FF736137B01,?,?,?,?,00007FF73613F347,?,?,00000000,00007FF73613BB16,?,?,?), ref: 00007FF73613BAA7
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Value$ErrorLast
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2506987500-0
                                                                                                                                                                                                    • Opcode ID: 08c8ab5cc42c296c137e99858cd49e9d9306b675dd67ec2a5b6d76651147f7e8
                                                                                                                                                                                                    • Instruction ID: edf5c85127d0b0f0e5226c83297d4fe163cca03486cdd134ce7b412751b535bf
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 08c8ab5cc42c296c137e99858cd49e9d9306b675dd67ec2a5b6d76651147f7e8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1C118E60F0D682A6FA2477257D81C3BF2B15F647B0FA44734D93F067E6EE2DA4016620
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612CBE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                    • String ID: csm$f
                                                                                                                                                                                                    • API String ID: 2395640692-629598281
                                                                                                                                                                                                    • Opcode ID: 32545d4c47f040bba74e5ea0bdcd73701037cef92f52e37c862bc678331dcba4
                                                                                                                                                                                                    • Instruction ID: b8e535fcdd060d11745d956f8408793c1f5e2c58a8fb8ab8eeef28c00b587579
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 32545d4c47f040bba74e5ea0bdcd73701037cef92f52e37c862bc678331dcba4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: AD51C632A05609E6F794EF15F804E7ABB56FB41BC4F908135DB0A43748EF7AE8419790
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613A188 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                    • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                    • API String ID: 4061214504-1276376045
                                                                                                                                                                                                    • Opcode ID: 3afc71d507fac05b5ed0d469e57baf89a2c544465bde837164eef4acae6f6590
                                                                                                                                                                                                    • Instruction ID: 27b51c960175414bf46b375035c93b94f89c24dfac77e305804d30a8e4d81a4f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3afc71d507fac05b5ed0d469e57baf89a2c544465bde837164eef4acae6f6590
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C8F04F61A09706A1FA10AB24FC44B3BE370EF447A1F940235D66E462E4DF2DD189A720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736149CE0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _set_statfp
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1156100317-0
                                                                                                                                                                                                    • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                    • Instruction ID: e1a6ddd382fb5ae255dd0dd25d7f20493aac23e12257caef32190db6bb869608
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B119466E1CA3361F7663125FC46B7B92606F54370FD90A34E56E072DABE6C68407160
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613BAC0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • FlsGetValue.KERNEL32(?,?,?,00007FF73613ACD7,?,?,00000000,00007FF73613AF72,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613BADF
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF73613ACD7,?,?,00000000,00007FF73613AF72,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613BAFE
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF73613ACD7,?,?,00000000,00007FF73613AF72,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613BB26
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF73613ACD7,?,?,00000000,00007FF73613AF72,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613BB37
                                                                                                                                                                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF73613ACD7,?,?,00000000,00007FF73613AF72,?,?,?,?,?,00007FF736132A30), ref: 00007FF73613BB48
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Value
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3702945584-0
                                                                                                                                                                                                    • Opcode ID: 68f1a5b59a4363200bcbb9faf55cf5cbffb41b92dd801ba04b72672f7fa6c872
                                                                                                                                                                                                    • Instruction ID: ff47bacf8c6b2f484737c2e38d45c51f797da6564e91935bb4326c6f1d9bed36
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 68f1a5b59a4363200bcbb9faf55cf5cbffb41b92dd801ba04b72672f7fa6c872
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4411A260F0864261F96477267D81D7BE1715F647B0FA48334D93F0A6EAED2DE8016220
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613B954 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Value
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3702945584-0
                                                                                                                                                                                                    • Opcode ID: 12028b8994822521587b7fbf501a1af6cdef8734b07dc22e78981075a4809b4e
                                                                                                                                                                                                    • Instruction ID: ca383b7c00c9d9124be785381de5c29e3cf7815caf06d696c97b2a7397e281e4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 12028b8994822521587b7fbf501a1af6cdef8734b07dc22e78981075a4809b4e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BC1106A0E0824666F968BB267C52D7BD2614F65370FB44734D93F4A2D2ED2EB8416720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361365B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: verbose
                                                                                                                                                                                                    • API String ID: 3215553584-579935070
                                                                                                                                                                                                    • Opcode ID: fe1e8efda0cf6c93562b921e4ec050f1932563884317df94160744cb1de47bce
                                                                                                                                                                                                    • Instruction ID: 30661c07e3395aa159854065a6a4f3d49883053a9b722dcee1a926853948b7e5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fe1e8efda0cf6c93562b921e4ec050f1932563884317df94160744cb1de47bce
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F8911622A1874691F7A0AE25EC50B7FB790AB05B94FE44135CA5F433D4DF3EE425A3A0
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736140648 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                    • API String ID: 3215553584-1196891531
                                                                                                                                                                                                    • Opcode ID: 4912b9a276ea6b0ee464adec09a88577ab1846fcb38840d9ab65cd82949928d4
                                                                                                                                                                                                    • Instruction ID: 11b473bf891292a18cf8a4ab5b32737f7c23dfd98db0b3118c4680fd5659110b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4912b9a276ea6b0ee464adec09a88577ab1846fcb38840d9ab65cd82949928d4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1A811972D0C223A5F666BF27EA00A7AB7B0AF10745FD58034CA4D57285EB2DE901B761
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612E448 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                    • String ID: MOC$RCC
                                                                                                                                                                                                    • API String ID: 3544855599-2084237596
                                                                                                                                                                                                    • Opcode ID: 7d1f5c32fac8fd219933c7cb1fe3be27179bc5359f2147a1a878e24407a37289
                                                                                                                                                                                                    • Instruction ID: deecd048fbd5d89c1ddb2ed1b54dfcd48773fddc22a0408869f64560772bcc5d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7d1f5c32fac8fd219933c7cb1fe3be27179bc5359f2147a1a878e24407a37289
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 35618E36A08B89DAF7209F65E8807AEB7A1FB48B88F544225EF4D13B94DF38D155C710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612E7A4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                    • String ID: csm$csm
                                                                                                                                                                                                    • API String ID: 3896166516-3733052814
                                                                                                                                                                                                    • Opcode ID: 2344b2513cb5a57a44c3f927fcd328a5c7284e883d3b63cfa6a166e05da3f2a9
                                                                                                                                                                                                    • Instruction ID: 51f31f9f38e2c42de5ec0c52134cc20df39073594e9e3152ebc7d4deedf0d9de
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2344b2513cb5a57a44c3f927fcd328a5c7284e883d3b63cfa6a166e05da3f2a9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5951C732908249D6FF74AF11E84476AB6A2FB49B84F944136DA8C47BD5CF3CE460E710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736123040 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetModuleFileNameW.KERNEL32(?,00007FF736122ABF), ref: 00007FF736123071
                                                                                                                                                                                                      • Part of subcall function 00007FF736122010: GetLastError.KERNEL32(?,?,00000000,00007FF736127A02,?,?,?,?,?,?,?,?,?,?,?,00007FF736121023), ref: 00007FF736122037
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                    • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                    • API String ID: 2776309574-1977442011
                                                                                                                                                                                                    • Opcode ID: 6ec499c9bbf6a572b3054b82fe14c33e4dcc97cf6ace112eeb76731709b9cc9e
                                                                                                                                                                                                    • Instruction ID: 2da805df85f155e0baba90135854ac36e8ce211fbef544a2b2732d6ee3cfd51e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6ec499c9bbf6a572b3054b82fe14c33e4dcc97cf6ace112eeb76731709b9cc9e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6A015E10B1964AE0FA65B721FC55BBB9372AF48784FC00031D94DC6286FE5CE248A634
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613CCD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2718003287-0
                                                                                                                                                                                                    • Opcode ID: b784c51ec96e096703386529b43dc9f5c366a276b0023c617d71174aed426b60
                                                                                                                                                                                                    • Instruction ID: 1dfb687a7ba8e15f26fd97a80d7b59763f6d6a8e369bbc92a0505cc46e0f12cc
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b784c51ec96e096703386529b43dc9f5c366a276b0023c617d71174aed426b60
                                                                                                                                                                                                    • Instruction Fuzzy Hash: EBD15632F18A809AF711DF75E840AAE7771FB45B98B904235CE4E97B89DE39D406D310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736127BB0 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Window$Process$ConsoleCurrentShowThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 242035731-0
                                                                                                                                                                                                    • Opcode ID: 956fe9210a89111325b9e15dd618e34b6c3e0a2566d1dc7a1a5aeddd5cac44f8
                                                                                                                                                                                                    • Instruction ID: 3e645fc4842da5d733cf3df081ac7c5ff64027d2458f53dc509c985395fb01c9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 956fe9210a89111325b9e15dd618e34b6c3e0a2566d1dc7a1a5aeddd5cac44f8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 41F0A721A18747D3FE516B22BC4493BA271FF48B81F845030E91E07754EE3CE085D720
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73614632C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: ?
                                                                                                                                                                                                    • API String ID: 1286766494-1684325040
                                                                                                                                                                                                    • Opcode ID: 75b13eedf9d65256e9a06c9befc4d813dc24ca345a8d8e96bcb9d2bb8bb26328
                                                                                                                                                                                                    • Instruction ID: 8b5c359d54a3f3123a0b062ff31f2ebdb3d62ae266a4f6b70652b91dc7e89c23
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 75b13eedf9d65256e9a06c9befc4d813dc24ca345a8d8e96bcb9d2bb8bb26328
                                                                                                                                                                                                    • Instruction Fuzzy Hash: AB414C12A1829161FB66A725F801B7BD670EF80BA8F544234EE5C07AD9EE3CD451D750
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF736139718 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • _invalid_parameter_noinfo.LIBCMT ref: 00007FF73613974A
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B07C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B092
                                                                                                                                                                                                      • Part of subcall function 00007FF73613B07C: GetLastError.KERNEL32(?,?,?,00007FF736143432,?,?,?,00007FF73614346F,?,?,00000000,00007FF736143935,?,?,00000000,00007FF736143867), ref: 00007FF73613B09C
                                                                                                                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF73612B465), ref: 00007FF736139768
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: C:\Users\user\Desktop\prank.exe
                                                                                                                                                                                                    • API String ID: 2553983749-211155896
                                                                                                                                                                                                    • Opcode ID: 4a9a74198bde06e718b11ab5db0903b3a28fd2266d2fae4f048bb14d55869b22
                                                                                                                                                                                                    • Instruction ID: ca5052d745433da8ea12b33956cbae7edbf3b590f62b4d44607cfa352ecbd026
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4a9a74198bde06e718b11ab5db0903b3a28fd2266d2fae4f048bb14d55869b22
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9B41A336A08752A5F714BF15BD418BAA7A4EB847C0BA44435EE0E47B95EF3ED481A320
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613D368 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorFileLastWrite
                                                                                                                                                                                                    • String ID: U
                                                                                                                                                                                                    • API String ID: 442123175-4171548499
                                                                                                                                                                                                    • Opcode ID: 2d6617a510d3af2bd0a1383b807dc0a12ca6134559daa664b20326d0d0fa2a2e
                                                                                                                                                                                                    • Instruction ID: b53e75350f6b0418a342b2ecc63154e9debced160ea55be96ded3e77a91eba3d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2d6617a510d3af2bd0a1383b807dc0a12ca6134559daa664b20326d0d0fa2a2e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2041C362B18A4591EB20EF25F8447ABA761FB84794F904031EE4E87B88EF3DE445D710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73613F9B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentDirectory
                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                    • API String ID: 1611563598-336475711
                                                                                                                                                                                                    • Opcode ID: 20808f164323b0bf33b14833328890cc422281d5ca00b5c90890a7691e4e9210
                                                                                                                                                                                                    • Instruction ID: 6a982d4e3c494404dfa381487862267a59333998293450c2fd11df7d0ba3215e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 20808f164323b0bf33b14833328890cc422281d5ca00b5c90890a7691e4e9210
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 75212832B0828195FB20AB25E844A7FB3B1FB88B84FD54035DA8E43294DF7DE9449760
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF73612F2F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                    • String ID: csm
                                                                                                                                                                                                    • API String ID: 2573137834-1018135373
                                                                                                                                                                                                    • Opcode ID: 16b202b15101b8ebbb751d08f6feac9de0ec5cf83f04436770b3162e97c86bb0
                                                                                                                                                                                                    • Instruction ID: 04d278a28f5ae57388ae7098461f18dd302f489e6a102111c3da0e85005ca3a3
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 16b202b15101b8ebbb751d08f6feac9de0ec5cf83f04436770b3162e97c86bb0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 11115B32608B4592EB21DF25F80066AB7E1FB88B94F984230DE8C07758EF3CD551DB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FF7361404BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000000.00000002.1913229854.00007FF736121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF736120000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913187558.00007FF736120000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913335636.00007FF73614B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF73615E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913415962.00007FF736160000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000000.00000002.1913504582.00007FF736162000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_7ff736120000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                    • API String ID: 2595371189-336475711
                                                                                                                                                                                                    • Opcode ID: 89a5c747472b5d9530e43b66d6404f09c67431a90ee7f4aa188d2f27ac3d5b78
                                                                                                                                                                                                    • Instruction ID: 0e607047115985c0d58ed199d3c27c98893dedee9670cf1ff8201690c7a21568
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 89a5c747472b5d9530e43b66d6404f09c67431a90ee7f4aa188d2f27ac3d5b78
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1401D46291821292F721BF21BC65A7FA3B0EF44345FC40035D60D87291EE2CE544EB34
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                    Execution Coverage:0.6%
                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                    Signature Coverage:12.8%
                                                                                                                                                                                                    Total number of Nodes:937
                                                                                                                                                                                                    Total number of Limit Nodes:77
                                                                                                                                                                                                    execution_graph 83866 7ffe0eb41e64 83867 7ffe0eb41e70 PyModule_GetState 83866->83867 83868 7ffe0eb41e8d 83867->83868 83869 7ffe0eb41e9a 83867->83869 83868->83869 83870 7ffe0eb436ec _Py_Dealloc 83868->83870 83871 7ffe0eb41eb1 83869->83871 83872 7ffe0eb436f8 _Py_Dealloc 83869->83872 83870->83869 83873 7ffe0eb41ec8 83871->83873 83874 7ffe0eb43704 _Py_Dealloc 83871->83874 83872->83871 83875 7ffe0eb41edf 83873->83875 83876 7ffe0eb43710 _Py_Dealloc 83873->83876 83874->83873 83877 7ffe0eb41ef6 83875->83877 83878 7ffe0eb4371c _Py_Dealloc 83875->83878 83876->83875 83879 7ffe0eb41f0d 83877->83879 83880 7ffe0eb43728 _Py_Dealloc 83877->83880 83878->83877 83881 7ffe0eb41f24 83879->83881 83882 7ffe0eb43734 _Py_Dealloc 83879->83882 83880->83879 83883 7ffe0eb41f3b 83881->83883 83884 7ffe0eb43740 _Py_Dealloc 83881->83884 83882->83881 83885 7ffe0eb41f52 83883->83885 83886 7ffe0eb4374c _Py_Dealloc 83883->83886 83884->83883 83887 7ffe0eb41f69 83885->83887 83888 7ffe0eb43758 _Py_Dealloc 83885->83888 83886->83885 83889 7ffe0eb41f80 83887->83889 83890 7ffe0eb43764 _Py_Dealloc 83887->83890 83888->83887 83891 7ffe0eb41f97 83889->83891 83892 7ffe0eb43770 _Py_Dealloc 83889->83892 83890->83889 83893 7ffe0eb41faa _Py_Dealloc 83891->83893 83895 7ffe0eb41fb0 83891->83895 83892->83891 83893->83895 83894 7ffe0eb41fc9 83897 7ffe0eb41fe2 83894->83897 83898 7ffe0eb41fdc _Py_Dealloc 83894->83898 83895->83894 83896 7ffe0eb41fc3 _Py_Dealloc 83895->83896 83896->83894 83899 7ffe0eb41ff9 83897->83899 83900 7ffe0eb4377c _Py_Dealloc 83897->83900 83898->83897 83901 7ffe0eb42016 83899->83901 83903 7ffe0eb43788 _Py_Dealloc 83899->83903 83900->83899 83902 7ffe0eb4202f 83901->83902 83904 7ffe0eb4207a _Py_Dealloc 83901->83904 83905 7ffe0eb4204e 83902->83905 83906 7ffe0eb42048 _Py_Dealloc 83902->83906 83903->83901 83904->83902 83907 7ffe0eb4206d 83905->83907 83908 7ffe0eb42067 _Py_Dealloc 83905->83908 83906->83905 83908->83907 83909 7ffe126e45b8 PyArg_ParseTuple 83910 7ffe126e45ea PySys_Audit 83909->83910 83911 7ffe126e466f 83909->83911 83910->83911 83912 7ffe126e4607 PyUnicode_AsWideCharString 83910->83912 83912->83911 83913 7ffe126e461c PyEval_SaveThread LoadLibraryW 83912->83913 83914 7ffe126e8e9a GetLastError 83913->83914 83915 7ffe126e4641 PyEval_RestoreThread PyMem_Free 83913->83915 83916 7ffe126e8ea7 PyErr_Format 83914->83916 83915->83916 83917 7ffe126e465e 83915->83917 83916->83911 83918 7ffe126e8ec9 PyErr_SetFromWindowsErr 83917->83918 83919 7ffe126e4666 PyLong_FromVoidPtr 83917->83919 83918->83911 83919->83911 83920 7ffe014c1e90 PyList_New 83921 7ffe014c1eb7 83920->83921 83922 7ffe014c1eae 83920->83922 83923 7ffe014c1edf 83921->83923 83924 7ffe014c1f3e 83921->83924 83928 7ffe014c1fcd malloc 83923->83928 83934 7ffe014c1ef1 PyErr_SetFromWindowsErr 83923->83934 83925 7ffe014c1f46 __acrt_iob_func 83924->83925 83926 7ffe014c1fa1 83924->83926 83951 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 83925->83951 83926->83928 83929 7ffe014c1fad PyErr_SetString 83926->83929 83932 7ffe014c1fe6 PyErr_NoMemory 83928->83932 83933 7ffe014c1ff1 NtQuerySystemInformation 83928->83933 83929->83928 83931 7ffe014c1ef9 83929->83931 83930 7ffe014c1f6d __acrt_iob_func 83952 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 83930->83952 83936 7ffe014c1f09 83931->83936 83937 7ffe014c1f00 _Py_Dealloc 83931->83937 83932->83931 83938 7ffe014c200d 83933->83938 83948 7ffe014c2020 83933->83948 83934->83931 83942 7ffe014c1f17 83936->83942 83943 7ffe014c1f0e free 83936->83943 83937->83936 83954 7ffe014c1350 11 API calls 83938->83954 83939 7ffe014c2146 free 83947 7ffe014c2157 83939->83947 83940 7ffe014c1f87 __acrt_iob_func 83953 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 83940->83953 83943->83942 83944 7ffe014c2040 Py_BuildValue 83944->83931 83946 7ffe014c2112 PyList_Append 83944->83946 83946->83947 83946->83948 83947->83931 83949 7ffe014c2167 _Py_Dealloc 83947->83949 83948->83939 83948->83944 83950 7ffe014c212e _Py_Dealloc 83948->83950 83949->83931 83950->83948 83951->83930 83952->83940 83953->83926 83954->83931 83955 7ffe014c44b0 PyArg_ParseTuple 83956 7ffe014c4518 83955->83956 83957 7ffe014c44d3 83955->83957 83958 7ffe014c44e9 OpenProcess 83957->83958 83959 7ffe014c44db 83957->83959 83961 7ffe014c4501 GetLastError 83958->83961 83962 7ffe014c4525 83958->83962 84029 7ffe014c1180 83959->84029 83961->83962 83965 7ffe014c450c 83961->83965 83976 7ffe014c79b0 83962->83976 83964 7ffe014c44e7 83964->83956 83967 7ffe014c4537 GetProcessTimes 83964->83967 84037 7ffe014c1070 11 API calls 83965->84037 83968 7ffe014c45a8 CloseHandle 83967->83968 83969 7ffe014c455d GetLastError 83967->83969 83972 7ffe014c45d2 Py_BuildValue 83968->83972 83970 7ffe014c4568 83969->83970 83971 7ffe014c458a PyErr_SetFromWindowsErr CloseHandle 83969->83971 84038 7ffe014c10e0 12 API calls 83970->84038 83975 7ffe014c4574 CloseHandle 83977 7ffe014c79cd GetLastError 83976->83977 83978 7ffe014c7b1c GetExitCodeProcess 83976->83978 83981 7ffe014c79d8 83977->83981 83982 7ffe014c79f1 GetLastError 83977->83982 83979 7ffe014c7b6b GetLastError 83978->83979 83980 7ffe014c7b2b 83978->83980 83985 7ffe014c7b76 83979->83985 83986 7ffe014c7bee 83979->83986 83988 7ffe014c7b39 83980->83988 83989 7ffe014c7be0 83980->83989 84039 7ffe014c10e0 12 API calls 83981->84039 83983 7ffe014c79ff 83982->83983 83984 7ffe014c7b03 83982->83984 84040 7ffe014c7860 12 API calls fprintf 83983->84040 84048 7ffe014c1070 11 API calls 83984->84048 83992 7ffe014c7bd8 SetLastError 83985->83992 83993 7ffe014c7b7f __acrt_iob_func 83985->83993 84054 7ffe014c1070 11 API calls 83986->84054 84049 7ffe014c7860 12 API calls fprintf 83988->84049 83989->83964 83990 7ffe014c79e4 83990->83964 83992->83989 84051 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 83993->84051 83997 7ffe014c7bfa CloseHandle 83997->83964 83998 7ffe014c7b40 83998->83989 84002 7ffe014c7b49 CloseHandle 83998->84002 83999 7ffe014c7a06 84003 7ffe014c7a86 83999->84003 84004 7ffe014c7a0b 83999->84004 84001 7ffe014c7b0f 84001->83964 84050 7ffe014c10e0 12 API calls 84002->84050 84006 7ffe014c7aea 84003->84006 84007 7ffe014c7a8f __acrt_iob_func 84003->84007 84009 7ffe014c7a6d 84004->84009 84010 7ffe014c7a14 __acrt_iob_func 84004->84010 84005 7ffe014c7ba4 __acrt_iob_func 84052 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84005->84052 84047 7ffe014c10e0 12 API calls 84006->84047 84044 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84007->84044 84017 7ffe014c1180 12 API calls 84009->84017 84041 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84010->84041 84013 7ffe014c7b5e 84013->83964 84016 7ffe014c7bbe __acrt_iob_func 84053 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84016->84053 84022 7ffe014c7a79 84017->84022 84018 7ffe014c7ab6 __acrt_iob_func 84045 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84018->84045 84019 7ffe014c7af6 84019->83964 84020 7ffe014c7a39 __acrt_iob_func 84042 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84020->84042 84022->83964 84025 7ffe014c7ad0 __acrt_iob_func 84046 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84025->84046 84026 7ffe014c7a53 __acrt_iob_func 84043 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84026->84043 84055 7ffe014c1010 84029->84055 84031 7ffe014c11af PyObject_CallFunction PyErr_SetObject 84032 7ffe014c11ec 84031->84032 84033 7ffe014c11fb 84031->84033 84032->84033 84034 7ffe014c11f2 _Py_Dealloc 84032->84034 84058 7ffe014ca030 84033->84058 84034->84033 84037->83956 84038->83975 84039->83990 84040->83999 84041->84020 84042->84026 84043->84009 84044->84018 84045->84025 84046->84006 84047->84019 84048->84001 84049->83998 84050->84013 84051->84005 84052->84016 84053->83992 84054->83997 84067 7ffe014c1000 84055->84067 84057 7ffe014c1036 __stdio_common_vsprintf 84057->84031 84059 7ffe014ca039 84058->84059 84060 7ffe014ca084 IsProcessorFeaturePresent 84059->84060 84061 7ffe014c120d 84059->84061 84062 7ffe014ca09c 84060->84062 84061->83964 84068 7ffe014ca158 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 84062->84068 84064 7ffe014ca0af 84069 7ffe014ca050 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 84064->84069 84067->84057 84068->84064 84070 7ffe014c4130 PyList_New 84071 7ffe014c4146 84070->84071 84072 7ffe014c414c 84070->84072 84086 7ffe014c77b0 84072->84086 84074 7ffe014c41e0 84075 7ffe014c41e6 _Py_Dealloc 84074->84075 84076 7ffe014c41ef 84074->84076 84075->84076 84078 7ffe014c41fd 84076->84078 84079 7ffe014c41f4 free 84076->84079 84077 7ffe014c41bd free 84077->84078 84079->84078 84080 7ffe014c4180 PyLong_FromLong 84080->84074 84081 7ffe014c4192 PyList_Append 84080->84081 84082 7ffe014c41cb 84081->84082 84083 7ffe014c416a 84081->84083 84082->84074 84084 7ffe014c41d7 _Py_Dealloc 84082->84084 84083->84074 84083->84077 84083->84080 84085 7ffe014c41ae _Py_Dealloc 84083->84085 84084->84074 84085->84083 84092 7ffe014c77d0 84086->84092 84087 7ffe014c77db free 84088 7ffe014c77e4 malloc 84087->84088 84089 7ffe014c783d PyErr_NoMemory 84088->84089 84090 7ffe014c77fb K32EnumProcesses 84088->84090 84093 7ffe014c781f 84089->84093 84091 7ffe014c782a free PyErr_SetFromWindowsErr 84090->84091 84090->84092 84091->84093 84092->84087 84092->84088 84092->84093 84093->84083 84094 7ffe148e42b0 84097 7ffe148e42e0 84094->84097 84098 7ffe148e4334 84097->84098 84102 7ffe148e4395 84097->84102 84099 7ffe148e436b memcpy 84098->84099 84098->84102 84099->84098 84101 7ffe148e4493 84107 7ffe148e49a0 8 API calls 2 library calls 84101->84107 84105 7ffe148e4730 GetConsoleScreenBufferInfo 84102->84105 84104 7ffe148e42c2 84106 7ffe148e478c 84105->84106 84106->84101 84107->84104 84108 7ffe0eb41170 PyModule_GetState PyDict_New 84109 7ffe0eb411a7 PyDict_New 84108->84109 84110 7ffe0eb41328 84108->84110 84109->84110 84111 7ffe0eb411ba PyDict_New 84109->84111 84111->84110 84126 7ffe0eb411cd 84111->84126 84112 7ffe0eb411e4 PyUnicode_FromString 84112->84110 84116 7ffe0eb411f9 _Py_BuildValue_SizeT 84112->84116 84113 7ffe0eb412e0 PyModule_AddObjectRef 84113->84110 84115 7ffe0eb412f8 PyModule_AddObjectRef 84113->84115 84114 7ffe0eb41280 PyLong_FromLong PyUnicode_FromString 84114->84110 84124 7ffe0eb4126f 84114->84124 84115->84110 84117 7ffe0eb41310 PyModule_AddObjectRef 84115->84117 84118 7ffe0eb43565 84116->84118 84119 7ffe0eb41218 PyDict_SetItem 84116->84119 84117->84110 84118->84110 84123 7ffe0eb4356f _Py_Dealloc 84118->84123 84121 7ffe0eb41230 PyDict_SetItem 84119->84121 84122 7ffe0eb43556 84119->84122 84120 7ffe0eb412aa PyDict_SetItem 84120->84110 84120->84124 84125 7ffe0eb43538 _Py_Dealloc 84121->84125 84121->84126 84122->84118 84127 7ffe0eb4355c _Py_Dealloc 84122->84127 84123->84110 84124->84110 84124->84113 84124->84114 84124->84120 84128 7ffe0eb4357e _Py_Dealloc 84124->84128 84130 7ffe0eb4358d _Py_Dealloc 84124->84130 84129 7ffe0eb43547 _Py_Dealloc 84125->84129 84126->84110 84126->84112 84126->84124 84126->84129 84127->84118 84128->84130 84129->84122 84131 7ffe102545e4 84139 7ffe10253584 84131->84139 84134 7ffe10254628 PySys_Audit 84135 7ffe10254646 PyEval_SaveThread bind PyEval_RestoreThread 84134->84135 84138 7ffe10254682 84134->84138 84135->84138 84137 7ffe102546a5 84166 7ffe10252280 8 API calls 2 library calls 84138->84166 84140 7ffe102535b2 84139->84140 84141 7ffe10253765 _PyArg_ParseTuple_SizeT 84139->84141 84142 7ffe1025364a 84140->84142 84143 7ffe102535bb 84140->84143 84147 7ffe102537b2 PyErr_ExceptionMatches 84141->84147 84148 7ffe102537f9 84141->84148 84145 7ffe10253695 _PyArg_ParseTuple_SizeT 84142->84145 84146 7ffe10253671 PyErr_Format 84142->84146 84150 7ffe102535c0 PyErr_Format 84143->84150 84154 7ffe102535ec _PyArg_ParseTuple_SizeT 84143->84154 84145->84147 84151 7ffe102536d3 84145->84151 84149 7ffe10253631 84146->84149 84147->84149 84147->84150 84169 7ffe102541bc 21 API calls 84148->84169 84149->84134 84149->84138 84150->84149 84168 7ffe102541bc 21 API calls 84151->84168 84154->84150 84157 7ffe10253624 84154->84157 84156 7ffe10253812 84159 7ffe10253831 84156->84159 84162 7ffe1025382b _Py_Dealloc 84156->84162 84167 7ffe102540d0 PyErr_SetString __stdio_common_vsscanf 84157->84167 84158 7ffe102536e9 84161 7ffe10253709 84158->84161 84163 7ffe10253703 _Py_Dealloc 84158->84163 84159->84149 84159->84150 84164 7ffe1025383f htons 84159->84164 84161->84149 84161->84150 84165 7ffe10253736 htons htonl 84161->84165 84162->84159 84163->84161 84164->84149 84165->84149 84166->84137 84167->84149 84168->84158 84169->84156 84170 7ffe0e168970 84171 7ffe0e16898a 84170->84171 84172 7ffe0e168998 PyModule_Create2 84170->84172 84173 7ffe0e168a90 84172->84173 84174 7ffe0e1689ba PyObject_GetAttrString PyModule_GetDict 84172->84174 84175 7ffe0e168aa4 84173->84175 84178 7ffe0e168a9b _Py_Dealloc 84173->84178 84176 7ffe0e168a6e 84174->84176 84177 7ffe0e1689ea 84174->84177 84180 7ffe0e168ac3 84175->84180 84184 7ffe0e168abd _Py_Dealloc 84175->84184 84176->84173 84182 7ffe0e168a87 _Py_Dealloc 84176->84182 84179 7ffe0e168a36 84177->84179 84207 7ffe0e164080 84177->84207 84178->84175 84179->84176 84225 7ffe0e171660 84179->84225 84185 7ffe0e168ae2 84180->84185 84186 7ffe0e168adc _Py_Dealloc 84180->84186 84182->84173 84184->84180 84188 7ffe0e168b01 84185->84188 84190 7ffe0e168afb _Py_Dealloc 84185->84190 84186->84185 84187 7ffe0e168a49 84187->84176 84189 7ffe0e168a4d 84187->84189 84191 7ffe0e168b20 84188->84191 84194 7ffe0e168b1a _Py_Dealloc 84188->84194 84192 7ffe0e168a53 _Py_Dealloc 84189->84192 84193 7ffe0e168a5c 84189->84193 84190->84188 84195 7ffe0e168b3f 84191->84195 84196 7ffe0e168b39 _Py_Dealloc 84191->84196 84192->84193 84194->84191 84197 7ffe0e168b5e 84195->84197 84198 7ffe0e168b58 _Py_Dealloc 84195->84198 84196->84195 84199 7ffe0e168b7d 84197->84199 84201 7ffe0e168b77 _Py_Dealloc 84197->84201 84198->84197 84200 7ffe0e168b9c 84199->84200 84202 7ffe0e168b96 _Py_Dealloc 84199->84202 84203 7ffe0e168bbb 84200->84203 84204 7ffe0e168bb5 _Py_Dealloc 84200->84204 84201->84199 84202->84200 84205 7ffe0e168bda 84203->84205 84206 7ffe0e168bd4 _Py_Dealloc 84203->84206 84204->84203 84206->84205 84208 7ffe0e164101 84207->84208 84212 7ffe0e1641bf 84207->84212 84210 7ffe0e164165 PyUnicode_FromStringAndSize 84208->84210 84208->84212 84209 7ffe0e164341 PyFloat_FromDouble 84213 7ffe0e16449e 84209->84213 84214 7ffe0e164301 84209->84214 84210->84213 84215 7ffe0e16418d PyUnicode_InternInPlace 84210->84215 84211 7ffe0e16427a 84211->84211 84211->84214 84216 7ffe0e1642c0 PyLong_FromString 84211->84216 84212->84211 84217 7ffe0e164235 PyBytes_FromStringAndSize 84212->84217 84213->84179 84214->84209 84220 7ffe0e164367 84214->84220 84215->84208 84216->84211 84216->84213 84217->84212 84217->84213 84218 7ffe0e1643a0 PyComplex_FromDoubles 84218->84213 84218->84220 84219 7ffe0e1643e0 PyTuple_New 84219->84213 84221 7ffe0e1643cb 84219->84221 84220->84218 84220->84221 84221->84219 84223 7ffe0e164437 84221->84223 84222 7ffe0e164444 PyFrozenSet_New 84222->84213 84222->84223 84223->84213 84223->84222 84224 7ffe0e164470 PySet_Add 84223->84224 84224->84213 84224->84223 84226 7ffe0e1716af 84225->84226 84227 7ffe0e171679 PyImport_Import 84225->84227 84505 7ffe0e1644d0 PyImport_ImportModuleLevelObject 84226->84505 84228 7ffe0e171697 84227->84228 84503 7ffe0e17168e 84227->84503 84228->84226 84230 7ffe0e1716a9 _Py_Dealloc 84228->84230 84230->84226 84233 7ffe0e1729a9 84233->84187 84234 7ffe0e1716f5 84236 7ffe0e1644d0 15 API calls 84234->84236 84235 7ffe0e1716ef _Py_Dealloc 84235->84234 84237 7ffe0e171712 84236->84237 84238 7ffe0e171735 _Py_Dealloc 84237->84238 84239 7ffe0e17173b 84237->84239 84237->84503 84238->84239 84240 7ffe0e1644d0 15 API calls 84239->84240 84241 7ffe0e171758 84240->84241 84242 7ffe0e171781 84241->84242 84243 7ffe0e17177b _Py_Dealloc 84241->84243 84241->84503 84244 7ffe0e1644d0 15 API calls 84242->84244 84243->84242 84245 7ffe0e17179e 84244->84245 84246 7ffe0e1717c1 _Py_Dealloc 84245->84246 84247 7ffe0e1717c7 84245->84247 84245->84503 84246->84247 84248 7ffe0e1644d0 15 API calls 84247->84248 84249 7ffe0e1717e4 84248->84249 84250 7ffe0e17180d 84249->84250 84251 7ffe0e171807 _Py_Dealloc 84249->84251 84249->84503 84521 7ffe0e1638b0 42 API calls 84250->84521 84251->84250 84253 7ffe0e171822 84254 7ffe0e171835 PyTuple_Pack 84253->84254 84253->84503 84255 7ffe0e171884 PyObject_SetAttr 84254->84255 84256 7ffe0e1718a8 84254->84256 84257 7ffe0e1718a4 84255->84257 84258 7ffe0e17189b _Py_Dealloc 84255->84258 84522 7ffe0e163770 10 API calls 84256->84522 84257->84256 84260 7ffe0e1718d4 84257->84260 84258->84257 84263 7ffe0e171904 PyObject_SetItem 84260->84263 84264 7ffe0e1718fc PyDict_SetItem 84260->84264 84261 7ffe0e1718c1 84523 7ffe0e161320 _Py_Dealloc 84261->84523 84265 7ffe0e17190a 84263->84265 84264->84265 84267 7ffe0e171912 _Py_Dealloc 84265->84267 84268 7ffe0e17191b 84265->84268 84266 7ffe0e1718c9 84266->84187 84267->84268 84269 7ffe0e171923 PyTuple_Pack 84268->84269 84268->84503 84270 7ffe0e171948 84269->84270 84269->84503 84524 7ffe0e1638b0 42 API calls 84270->84524 84272 7ffe0e17195e 84273 7ffe0e171970 84272->84273 84274 7ffe0e171967 _Py_Dealloc 84272->84274 84275 7ffe0e171975 PyTuple_Pack 84273->84275 84273->84503 84274->84273 84276 7ffe0e171a42 84275->84276 84277 7ffe0e171a1e PyObject_SetAttr 84275->84277 84525 7ffe0e163770 10 API calls 84276->84525 84279 7ffe0e171a35 _Py_Dealloc 84277->84279 84280 7ffe0e171a3e 84277->84280 84279->84280 84280->84276 84282 7ffe0e171a6e 84280->84282 84281 7ffe0e171a5b 84526 7ffe0e161320 _Py_Dealloc 84281->84526 84284 7ffe0e171a9e PyObject_SetItem 84282->84284 84285 7ffe0e171a96 PyDict_SetItem 84282->84285 84287 7ffe0e171aa4 84284->84287 84285->84287 84286 7ffe0e171a63 84286->84187 84288 7ffe0e171ab5 84287->84288 84289 7ffe0e171aac _Py_Dealloc 84287->84289 84290 7ffe0e171abd PyTuple_Pack 84288->84290 84288->84503 84289->84288 84291 7ffe0e171ae2 84290->84291 84290->84503 84527 7ffe0e1638b0 42 API calls 84291->84527 84293 7ffe0e171af8 84294 7ffe0e171b01 _Py_Dealloc 84293->84294 84295 7ffe0e171b0a 84293->84295 84294->84295 84296 7ffe0e171b0f PyTuple_Pack 84295->84296 84295->84503 84297 7ffe0e171bbd 84296->84297 84298 7ffe0e171b99 PyObject_SetAttr 84296->84298 84528 7ffe0e163770 10 API calls 84297->84528 84299 7ffe0e171bb0 _Py_Dealloc 84298->84299 84300 7ffe0e171bb9 84298->84300 84299->84300 84300->84297 84302 7ffe0e171be9 84300->84302 84305 7ffe0e171c11 PyDict_SetItem 84302->84305 84306 7ffe0e171c19 PyObject_SetItem 84302->84306 84303 7ffe0e171bd6 84529 7ffe0e161320 _Py_Dealloc 84303->84529 84308 7ffe0e171c1f 84305->84308 84306->84308 84307 7ffe0e171bde 84307->84187 84309 7ffe0e171c30 84308->84309 84310 7ffe0e171c27 _Py_Dealloc 84308->84310 84311 7ffe0e171c38 PyTuple_Pack 84309->84311 84309->84503 84310->84309 84312 7ffe0e171c5d 84311->84312 84311->84503 84530 7ffe0e1638b0 42 API calls 84312->84530 84314 7ffe0e171c73 84315 7ffe0e171c85 84314->84315 84316 7ffe0e171c7c _Py_Dealloc 84314->84316 84317 7ffe0e171c8a PyTuple_Pack 84315->84317 84315->84503 84316->84315 84318 7ffe0e171d14 PyObject_SetAttr 84317->84318 84319 7ffe0e171d38 84317->84319 84320 7ffe0e171d34 84318->84320 84321 7ffe0e171d2b _Py_Dealloc 84318->84321 84531 7ffe0e163770 10 API calls 84319->84531 84320->84319 84323 7ffe0e171d64 84320->84323 84321->84320 84325 7ffe0e171d94 PyObject_SetItem 84323->84325 84326 7ffe0e171d8c PyDict_SetItem 84323->84326 84324 7ffe0e171d51 84532 7ffe0e161320 _Py_Dealloc 84324->84532 84328 7ffe0e171d9a 84325->84328 84326->84328 84330 7ffe0e171da2 _Py_Dealloc 84328->84330 84331 7ffe0e171dab 84328->84331 84329 7ffe0e171d59 84329->84187 84330->84331 84332 7ffe0e171db3 PyTuple_Pack 84331->84332 84331->84503 84333 7ffe0e171dd8 84332->84333 84332->84503 84533 7ffe0e1638b0 42 API calls 84333->84533 84335 7ffe0e171dee 84336 7ffe0e171e00 84335->84336 84337 7ffe0e171df7 _Py_Dealloc 84335->84337 84338 7ffe0e171e05 PyTuple_Pack 84336->84338 84336->84503 84337->84336 84339 7ffe0e171eba 84338->84339 84340 7ffe0e171e96 PyObject_SetAttr 84338->84340 84534 7ffe0e163770 10 API calls 84339->84534 84342 7ffe0e171ead _Py_Dealloc 84340->84342 84343 7ffe0e171eb6 84340->84343 84342->84343 84343->84339 84344 7ffe0e171ee6 84343->84344 84347 7ffe0e171f0e PyDict_SetItem 84344->84347 84348 7ffe0e171f16 PyObject_SetItem 84344->84348 84345 7ffe0e171ed3 84535 7ffe0e161320 _Py_Dealloc 84345->84535 84350 7ffe0e171f1c 84347->84350 84348->84350 84349 7ffe0e171edb 84349->84187 84351 7ffe0e171f24 _Py_Dealloc 84350->84351 84352 7ffe0e171f2d 84350->84352 84351->84352 84353 7ffe0e171f35 PyTuple_Pack 84352->84353 84352->84503 84354 7ffe0e171f5a 84353->84354 84353->84503 84536 7ffe0e1638b0 42 API calls 84354->84536 84356 7ffe0e171f70 84357 7ffe0e171f82 84356->84357 84358 7ffe0e171f79 _Py_Dealloc 84356->84358 84359 7ffe0e171f87 PyTuple_Pack 84357->84359 84357->84503 84358->84357 84360 7ffe0e17203c 84359->84360 84361 7ffe0e172018 PyObject_SetAttr 84359->84361 84537 7ffe0e163770 10 API calls 84360->84537 84362 7ffe0e17202f _Py_Dealloc 84361->84362 84363 7ffe0e172038 84361->84363 84362->84363 84363->84360 84365 7ffe0e172068 84363->84365 84368 7ffe0e172090 PyDict_SetItem 84365->84368 84369 7ffe0e172098 PyObject_SetItem 84365->84369 84366 7ffe0e172055 84538 7ffe0e161320 _Py_Dealloc 84366->84538 84371 7ffe0e17209e 84368->84371 84369->84371 84370 7ffe0e17205d 84370->84187 84372 7ffe0e1720af 84371->84372 84373 7ffe0e1720a6 _Py_Dealloc 84371->84373 84374 7ffe0e1720b7 PyTuple_Pack 84372->84374 84372->84503 84373->84372 84375 7ffe0e1720dc 84374->84375 84374->84503 84539 7ffe0e1638b0 42 API calls 84375->84539 84377 7ffe0e1720f2 84378 7ffe0e172104 84377->84378 84379 7ffe0e1720fb _Py_Dealloc 84377->84379 84380 7ffe0e172109 PyTuple_Pack 84378->84380 84378->84503 84379->84378 84381 7ffe0e1721e2 PyObject_SetAttr 84380->84381 84382 7ffe0e172206 84380->84382 84383 7ffe0e172202 84381->84383 84384 7ffe0e1721f9 _Py_Dealloc 84381->84384 84540 7ffe0e163770 10 API calls 84382->84540 84383->84382 84386 7ffe0e172232 84383->84386 84384->84383 84389 7ffe0e172262 PyObject_SetItem 84386->84389 84390 7ffe0e17225a PyDict_SetItem 84386->84390 84387 7ffe0e17221f 84541 7ffe0e161320 _Py_Dealloc 84387->84541 84392 7ffe0e172268 84389->84392 84390->84392 84391 7ffe0e172227 84391->84187 84393 7ffe0e172270 _Py_Dealloc 84392->84393 84394 7ffe0e172279 84392->84394 84393->84394 84395 7ffe0e172281 PyTuple_Pack 84394->84395 84394->84503 84396 7ffe0e1722a6 84395->84396 84395->84503 84542 7ffe0e1638b0 42 API calls 84396->84542 84398 7ffe0e1722bc 84399 7ffe0e1722c5 _Py_Dealloc 84398->84399 84400 7ffe0e1722ce 84398->84400 84399->84400 84401 7ffe0e1722d3 PyTuple_Pack 84400->84401 84400->84503 84402 7ffe0e172381 84401->84402 84403 7ffe0e17235d PyObject_SetAttr 84401->84403 84543 7ffe0e163770 10 API calls 84402->84543 84404 7ffe0e172374 _Py_Dealloc 84403->84404 84405 7ffe0e17237d 84403->84405 84404->84405 84405->84402 84407 7ffe0e1723ad 84405->84407 84410 7ffe0e1723d5 PyDict_SetItem 84407->84410 84411 7ffe0e1723dd PyObject_SetItem 84407->84411 84408 7ffe0e17239a 84544 7ffe0e161320 _Py_Dealloc 84408->84544 84413 7ffe0e1723e3 84410->84413 84411->84413 84412 7ffe0e1723a2 84412->84187 84414 7ffe0e1723f4 84413->84414 84415 7ffe0e1723eb _Py_Dealloc 84413->84415 84416 7ffe0e1723fc PyTuple_Pack 84414->84416 84414->84503 84415->84414 84417 7ffe0e172421 84416->84417 84416->84503 84545 7ffe0e1638b0 42 API calls 84417->84545 84419 7ffe0e172437 84420 7ffe0e172440 _Py_Dealloc 84419->84420 84421 7ffe0e172449 84419->84421 84420->84421 84422 7ffe0e17244e PyTuple_Pack 84421->84422 84421->84503 84423 7ffe0e172533 84422->84423 84424 7ffe0e17250f PyObject_SetAttr 84422->84424 84546 7ffe0e163770 10 API calls 84423->84546 84425 7ffe0e17252f 84424->84425 84426 7ffe0e172526 _Py_Dealloc 84424->84426 84425->84423 84428 7ffe0e17255f 84425->84428 84426->84425 84431 7ffe0e17258f PyObject_SetItem 84428->84431 84432 7ffe0e172587 PyDict_SetItem 84428->84432 84429 7ffe0e17254c 84547 7ffe0e161320 _Py_Dealloc 84429->84547 84433 7ffe0e172595 84431->84433 84432->84433 84435 7ffe0e17259d _Py_Dealloc 84433->84435 84436 7ffe0e1725a6 84433->84436 84434 7ffe0e172554 84434->84187 84435->84436 84437 7ffe0e1725ae PyTuple_Pack 84436->84437 84436->84503 84438 7ffe0e1725d3 84437->84438 84437->84503 84548 7ffe0e1638b0 42 API calls 84438->84548 84440 7ffe0e1725e9 84441 7ffe0e1725f2 _Py_Dealloc 84440->84441 84442 7ffe0e1725fb 84440->84442 84441->84442 84443 7ffe0e172600 PyTuple_Pack 84442->84443 84442->84503 84444 7ffe0e1726ae 84443->84444 84445 7ffe0e17268a PyObject_SetAttr 84443->84445 84549 7ffe0e163770 10 API calls 84444->84549 84447 7ffe0e1726a1 _Py_Dealloc 84445->84447 84448 7ffe0e1726aa 84445->84448 84447->84448 84448->84444 84450 7ffe0e1726da 84448->84450 84449 7ffe0e1726c7 84550 7ffe0e161320 _Py_Dealloc 84449->84550 84452 7ffe0e172702 PyDict_SetItem 84450->84452 84453 7ffe0e17270a PyObject_SetItem 84450->84453 84455 7ffe0e172710 84452->84455 84453->84455 84454 7ffe0e1726cf 84454->84187 84456 7ffe0e172721 84455->84456 84457 7ffe0e172718 _Py_Dealloc 84455->84457 84456->84503 84551 7ffe0e163430 PyDict_GetItemWithError PyErr_Occurred PyErr_SetObject PyObject_GetItem 84456->84551 84457->84456 84459 7ffe0e17273c 84459->84503 84552 7ffe0e163430 PyDict_GetItemWithError PyErr_Occurred PyErr_SetObject PyObject_GetItem 84459->84552 84461 7ffe0e172762 84462 7ffe0e1727e2 84461->84462 84463 7ffe0e17276a PyObject_Vectorcall 84461->84463 84553 7ffe0e163770 10 API calls 84462->84553 84464 7ffe0e17279d _Py_Dealloc 84463->84464 84465 7ffe0e1727a6 84463->84465 84464->84465 84465->84462 84467 7ffe0e1727ab PyObject_Vectorcall 84465->84467 84469 7ffe0e1727d4 _Py_Dealloc 84467->84469 84470 7ffe0e1727dd 84467->84470 84468 7ffe0e1727fb 84554 7ffe0e161320 _Py_Dealloc 84468->84554 84469->84470 84470->84462 84472 7ffe0e17280e 84470->84472 84474 7ffe0e172814 _Py_Dealloc 84472->84474 84475 7ffe0e17281d 84472->84475 84473 7ffe0e172803 84473->84187 84474->84475 84476 7ffe0e172843 PyObject_SetItem 84475->84476 84477 7ffe0e17283b PyDict_SetItem 84475->84477 84478 7ffe0e172849 84476->84478 84477->84478 84479 7ffe0e172851 _Py_Dealloc 84478->84479 84480 7ffe0e17285a 84478->84480 84479->84480 84480->84503 84555 7ffe0e163430 PyDict_GetItemWithError PyErr_Occurred PyErr_SetObject PyObject_GetItem 84480->84555 84482 7ffe0e172875 84482->84503 84556 7ffe0e163430 PyDict_GetItemWithError PyErr_Occurred PyErr_SetObject PyObject_GetItem 84482->84556 84484 7ffe0e172894 84485 7ffe0e172914 84484->84485 84486 7ffe0e17289c PyObject_Vectorcall 84484->84486 84557 7ffe0e163770 10 API calls 84485->84557 84488 7ffe0e1728cf _Py_Dealloc 84486->84488 84489 7ffe0e1728d8 84486->84489 84488->84489 84489->84485 84491 7ffe0e1728dd PyObject_Vectorcall 84489->84491 84490 7ffe0e17292d 84558 7ffe0e161320 _Py_Dealloc 84490->84558 84493 7ffe0e17290f 84491->84493 84494 7ffe0e172906 _Py_Dealloc 84491->84494 84493->84485 84495 7ffe0e172940 84493->84495 84494->84493 84497 7ffe0e17294f 84495->84497 84498 7ffe0e172946 _Py_Dealloc 84495->84498 84496 7ffe0e172935 84496->84187 84499 7ffe0e172975 PyObject_SetItem 84497->84499 84500 7ffe0e17296d PyDict_SetItem 84497->84500 84498->84497 84501 7ffe0e17297b 84499->84501 84500->84501 84502 7ffe0e172983 _Py_Dealloc 84501->84502 84501->84503 84502->84503 84504 7ffe0e1729b4 84503->84504 84559 7ffe0e163770 10 API calls 84503->84559 84504->84187 84506 7ffe0e164513 84505->84506 84507 7ffe0e164672 84505->84507 84506->84507 84508 7ffe0e164540 PyObject_GetAttr 84506->84508 84511 7ffe0e164601 PyErr_Clear PyModule_GetFilenameObject PyUnicode_FromFormat PyErr_SetImportError 84506->84511 84512 7ffe0e1645c0 PyObject_SetItem 84506->84512 84513 7ffe0e1645b8 PyDict_SetItem 84506->84513 84517 7ffe0e1645ce _Py_Dealloc 84506->84517 84518 7ffe0e164663 84506->84518 84507->84234 84507->84235 84507->84503 84508->84506 84509 7ffe0e16455b PyUnicode_FromFormat 84508->84509 84510 7ffe0e16457f PyObject_GetItem 84509->84510 84509->84511 84510->84506 84516 7ffe0e164594 _Py_Dealloc 84510->84516 84514 7ffe0e164654 84511->84514 84515 7ffe0e16464b _Py_Dealloc 84511->84515 84512->84506 84513->84506 84514->84518 84519 7ffe0e16465a _Py_Dealloc 84514->84519 84515->84514 84516->84506 84517->84506 84518->84507 84520 7ffe0e164669 _Py_Dealloc 84518->84520 84519->84518 84520->84507 84521->84253 84522->84261 84523->84266 84524->84272 84525->84281 84526->84286 84527->84293 84528->84303 84529->84307 84530->84314 84531->84324 84532->84329 84533->84335 84534->84345 84535->84349 84536->84356 84537->84366 84538->84370 84539->84377 84540->84387 84541->84391 84542->84398 84543->84408 84544->84412 84545->84419 84546->84429 84547->84434 84548->84440 84549->84449 84550->84454 84551->84459 84552->84461 84553->84468 84554->84473 84555->84482 84556->84484 84557->84490 84558->84496 84559->84233 84560 7ffe10254860 84561 7ffe102548b5 84560->84561 84562 7ffe10254877 PyEval_SaveThread closesocket PyEval_RestoreThread 84560->84562 84562->84561 84563 7ffe102548aa _errno 84562->84563 84563->84561 84564 7ffe014c18c0 PyModule_Create2 84565 7ffe014c18fd getenv 84564->84565 84566 7ffe014c1a21 84564->84566 84580 7ffe014c13d0 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 84565->84580 84568 7ffe014ca030 8 API calls 84566->84568 84570 7ffe014c1a33 84568->84570 84569 7ffe014c1926 84569->84566 84571 7ffe014c1940 RtlGetVersion 84569->84571 84573 7ffe014c1954 GetSystemInfo InitializeCriticalSection 84571->84573 84635 7ffe014c7db0 GetCurrentProcess OpenProcessToken 84573->84635 84576 7ffe014c19dd PyModule_GetState PyErr_NewException 84577 7ffe014c1a44 36 API calls 84576->84577 84578 7ffe014c1a13 84576->84578 84577->84566 84578->84566 84579 7ffe014c1a18 _Py_Dealloc 84578->84579 84579->84566 84581 7ffe014c1401 PyErr_SetFromWindowsErrWithFilename 84580->84581 84582 7ffe014c1412 GetProcAddress 84580->84582 84583 7ffe014c143f 84581->84583 84584 7ffe014c1458 GetModuleHandleA 84582->84584 84585 7ffe014c1427 PyErr_SetFromWindowsErrWithFilename FreeLibrary 84582->84585 84583->84569 84586 7ffe014c147a GetProcAddress 84584->84586 84587 7ffe014c1471 PyErr_SetFromWindowsErrWithFilename 84584->84587 84585->84583 84586->84587 84589 7ffe014c14b7 GetModuleHandleA 84586->84589 84587->84569 84590 7ffe014c14d9 GetProcAddress 84589->84590 84591 7ffe014c14d0 PyErr_SetFromWindowsErrWithFilename 84589->84591 84590->84591 84593 7ffe014c1516 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 84590->84593 84591->84569 84594 7ffe014c156a GetProcAddress 84593->84594 84595 7ffe014c1544 PyErr_SetFromWindowsErrWithFilename 84593->84595 84596 7ffe014c15b0 84594->84596 84597 7ffe014c157f PyErr_SetFromWindowsErrWithFilename FreeLibrary 84594->84597 84595->84569 84671 7ffe014c12c0 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 84596->84671 84597->84569 84600 7ffe014c12c0 7 API calls 84601 7ffe014c15ed 84600->84601 84601->84583 84602 7ffe014c12c0 7 API calls 84601->84602 84603 7ffe014c1610 84602->84603 84603->84583 84604 7ffe014c12c0 7 API calls 84603->84604 84605 7ffe014c1633 84604->84605 84605->84583 84606 7ffe014c12c0 7 API calls 84605->84606 84607 7ffe014c1656 84606->84607 84607->84583 84608 7ffe014c12c0 7 API calls 84607->84608 84609 7ffe014c1679 84608->84609 84609->84583 84610 7ffe014c12c0 7 API calls 84609->84610 84611 7ffe014c169c 84610->84611 84611->84583 84612 7ffe014c12c0 7 API calls 84611->84612 84613 7ffe014c16bf 84612->84613 84613->84583 84614 7ffe014c16cf GetModuleHandleA 84613->84614 84615 7ffe014c16ea GetProcAddress 84614->84615 84616 7ffe014c16e1 PyErr_SetFromWindowsErrWithFilename 84614->84616 84615->84616 84618 7ffe014c1727 84615->84618 84616->84569 84619 7ffe014c12c0 7 API calls 84618->84619 84620 7ffe014c1741 84619->84620 84620->84583 84621 7ffe014c1751 GetModuleHandleA 84620->84621 84622 7ffe014c176c GetProcAddress 84621->84622 84623 7ffe014c1763 84621->84623 84625 7ffe014c1781 84622->84625 84626 7ffe014c1792 84622->84626 84624 7ffe014c1788 PyErr_SetFromWindowsErrWithFilename 84623->84624 84624->84626 84625->84624 84627 7ffe014c12c0 7 API calls 84626->84627 84628 7ffe014c17ac 84627->84628 84629 7ffe014c12c0 7 API calls 84628->84629 84630 7ffe014c17c6 84629->84630 84631 7ffe014c12c0 7 API calls 84630->84631 84632 7ffe014c17e0 84631->84632 84633 7ffe014c12c0 7 API calls 84632->84633 84634 7ffe014c17fa PyErr_Clear 84633->84634 84634->84569 84636 7ffe014c7e09 GetLastError 84635->84636 84637 7ffe014c7e9d 84635->84637 84638 7ffe014c7e66 GetLastError 84636->84638 84639 7ffe014c7e16 ImpersonateSelf 84636->84639 84640 7ffe014c7ea7 84637->84640 84641 7ffe014c7eb1 LookupPrivilegeValueA 84637->84641 84642 7ffe014c1010 __stdio_common_vsprintf 84638->84642 84643 7ffe014c7e39 OpenProcessToken 84639->84643 84644 7ffe014c7e23 84639->84644 84645 7ffe014c7d10 7 API calls 84640->84645 84646 7ffe014c7ed1 GetLastError 84641->84646 84647 7ffe014c7f03 AdjustTokenPrivileges 84641->84647 84648 7ffe014c7e86 PyErr_SetFromWindowsErrWithFilename 84642->84648 84643->84637 84650 7ffe014c7e50 84643->84650 84686 7ffe014c1070 11 API calls 84644->84686 84668 7ffe014c7e34 84645->84668 84651 7ffe014c1010 __stdio_common_vsprintf 84646->84651 84652 7ffe014c7f47 GetLastError 84647->84652 84653 7ffe014c7f7a AdjustTokenPrivileges 84647->84653 84656 7ffe014c7d10 7 API calls 84648->84656 84687 7ffe014c1070 11 API calls 84650->84687 84659 7ffe014c7ef1 PyErr_SetFromWindowsErrWithFilename 84651->84659 84660 7ffe014c1010 __stdio_common_vsprintf 84652->84660 84654 7ffe014c7fc5 RevertToSelf CloseHandle 84653->84654 84655 7ffe014c7fb4 84653->84655 84654->84668 84688 7ffe014c1070 11 API calls 84655->84688 84656->84668 84657 7ffe014c7e2f 84662 7ffe014c7d10 7 API calls 84657->84662 84665 7ffe014c7fc0 84659->84665 84666 7ffe014c7f69 PyErr_SetFromWindowsErrWithFilename 84660->84666 84662->84668 84663 7ffe014ca030 8 API calls 84669 7ffe014c19d9 84663->84669 84664 7ffe014c7e5c 84670 7ffe014c7d10 7 API calls 84664->84670 84676 7ffe014c7d10 84665->84676 84666->84665 84668->84663 84669->84566 84669->84576 84670->84668 84672 7ffe014c12fd PyErr_SetFromWindowsErrWithFilename 84671->84672 84673 7ffe014c130a GetProcAddress 84671->84673 84674 7ffe014c132f 84672->84674 84673->84674 84675 7ffe014c131b PyErr_SetFromWindowsErrWithFilename FreeLibrary 84673->84675 84674->84583 84674->84600 84675->84674 84677 7ffe014c7d78 GetLastError 84676->84677 84678 7ffe014c7d1d __acrt_iob_func 84676->84678 84680 7ffe014c7da0 PyErr_Clear 84677->84680 84681 7ffe014c7d83 PyErr_WarnEx 84677->84681 84689 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84678->84689 84681->84680 84682 7ffe014c7d44 __acrt_iob_func 84690 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84682->84690 84684 7ffe014c7d5e __acrt_iob_func 84691 7ffe014c1d70 __stdio_common_vfprintf swprintf_s 84684->84691 84686->84657 84687->84664 84688->84665 84689->84682 84690->84684 84691->84677 84692 7ffe014c1dc0 GetSystemTimes 84693 7ffe014c1ddd PyErr_SetFromWindowsErr 84692->84693 84694 7ffe014c1dec Py_BuildValue 84692->84694 84695 7ffe014c4680 PyArg_ParseTuple 84696 7ffe014c48e6 84695->84696 84697 7ffe014c46b1 84695->84697 84698 7ffe014c46b9 84697->84698 84699 7ffe014c46d5 84697->84699 84700 7ffe014c1180 12 API calls 84698->84700 84731 7ffe014c7c90 84699->84731 84702 7ffe014c46c5 84700->84702 84704 7ffe014c46fa GetProcessHeap HeapAlloc 84707 7ffe014c471d NtQuerySystemInformation 84704->84707 84708 7ffe014c48e0 PyErr_NoMemory 84704->84708 84705 7ffe014c46de 84740 7ffe014c10e0 12 API calls 84705->84740 84710 7ffe014c4756 84707->84710 84711 7ffe014c4825 84707->84711 84708->84696 84709 7ffe014c46ea 84712 7ffe014c47cc GetProcessHeap HeapFree GetProcessHeap HeapAlloc 84710->84712 84723 7ffe014c475d 84710->84723 84713 7ffe014c4829 GetProcessHeap HeapFree 84711->84713 84714 7ffe014c4888 84711->84714 84712->84708 84718 7ffe014c4808 NtQuerySystemInformation 84712->84718 84719 7ffe014c7c90 50 API calls 84713->84719 84716 7ffe014c48a8 PyUnicode_FromWideChar 84714->84716 84717 7ffe014c4892 Py_BuildValue 84714->84717 84715 7ffe014c4760 GetProcessHeap HeapFree GetProcessHeap HeapAlloc 84715->84708 84720 7ffe014c4799 NtQuerySystemInformation 84715->84720 84721 7ffe014c48b6 GetProcessHeap HeapFree 84716->84721 84717->84721 84718->84711 84722 7ffe014c4846 84719->84722 84720->84711 84720->84723 84724 7ffe014c4868 84722->84724 84725 7ffe014c484a 84722->84725 84723->84715 84726 7ffe014c47ca 84723->84726 84742 7ffe014c1350 11 API calls 84724->84742 84741 7ffe014c10e0 12 API calls 84725->84741 84726->84713 84729 7ffe014c4876 84730 7ffe014c4856 84732 7ffe014c46da 84731->84732 84733 7ffe014c7ca0 OpenProcess 84731->84733 84732->84704 84732->84705 84734 7ffe014c7cb8 GetLastError 84733->84734 84735 7ffe014c7cc3 84733->84735 84734->84732 84734->84735 84736 7ffe014c79b0 45 API calls 84735->84736 84737 7ffe014c7ccd 84736->84737 84738 7ffe014c7ceb CloseHandle PyErr_Clear 84737->84738 84739 7ffe014c7cd2 CloseHandle 84737->84739 84739->84732 84740->84709 84741->84730 84742->84729 84743 7ffe120c1000 PyImport_ImportModule 84744 7ffe120c1016 84743->84744 84745 7ffe120c1039 84743->84745 84746 7ffe120c101c _Py_Dealloc 84744->84746 84747 7ffe120c1025 PyCapsule_Import 84744->84747 84746->84747 84747->84745 84748 7ffe014c7500 PyArg_ParseTuple 84749 7ffe014c779c 84748->84749 84750 7ffe014c752b 84748->84750 84754 7ffe014c73f0 malloc 84750->84754 84753 7ffe014c7681 Py_BuildValue free 84755 7ffe014c7471 PyErr_NoMemory 84754->84755 84759 7ffe014c7427 84754->84759 84756 7ffe014c7477 84755->84756 84756->84749 84756->84753 84757 7ffe014c7430 NtQuerySystemInformation 84758 7ffe014c7456 free malloc 84757->84758 84757->84759 84758->84755 84758->84757 84759->84757 84759->84758 84760 7ffe014c748f 84759->84760 84761 7ffe014c7493 84760->84761 84764 7ffe014c74ac 84760->84764 84767 7ffe014c1350 11 API calls 84761->84767 84763 7ffe014c74a1 free 84763->84756 84764->84756 84768 7ffe014c10e0 12 API calls 84764->84768 84766 7ffe014c74e5 free 84766->84756 84767->84763 84768->84766 84769 7ffe10303aa0 PyFrozenSet_New 84770 7ffe10303ac3 EVP_MD_do_all_provided 84769->84770 84773 7ffe10303aff 84769->84773 84771 7ffe10305396 84770->84771 84772 7ffe10303ae2 PyModule_AddObject 84770->84772 84771->84773 84774 7ffe103053a5 _Py_Dealloc 84771->84774 84772->84771 84772->84773 84774->84773 84775 7ffe10254ea8 84776 7ffe10254ee2 84775->84776 84777 7ffe10254f03 _PyArg_UnpackKeywords 84776->84777 84778 7ffe10254f4a 84776->84778 84777->84778 84779 7ffe10254fe0 84777->84779 84781 7ffe10254f6f 84778->84781 84782 7ffe10254f57 _PyLong_AsInt 84778->84782 84790 7ffe10254fbe 84778->84790 84827 7ffe10252280 8 API calls 2 library calls 84779->84827 84786 7ffe10254f7e _PyLong_AsInt 84781->84786 84787 7ffe10254f96 84781->84787 84781->84790 84782->84781 84784 7ffe10254f64 PyErr_Occurred 84782->84784 84784->84779 84784->84781 84785 7ffe10254ff4 84786->84787 84788 7ffe10254f8b PyErr_Occurred 84786->84788 84789 7ffe10254fa5 _PyLong_AsInt 84787->84789 84787->84790 84788->84779 84788->84787 84789->84790 84791 7ffe10254fb3 PyErr_Occurred 84789->84791 84792 7ffe10255008 84790->84792 84791->84779 84791->84790 84793 7ffe10255044 84792->84793 84794 7ffe10255050 PySys_Audit 84792->84794 84793->84794 84796 7ffe10255090 84793->84796 84795 7ffe10255077 84794->84795 84823 7ffe102550cb 84794->84823 84795->84796 84797 7ffe10255357 PyEval_SaveThread 84795->84797 84798 7ffe102550a4 84796->84798 84799 7ffe1025527f PyLong_AsLongLong 84796->84799 84800 7ffe102553c1 socket 84797->84800 84801 7ffe10255396 WSASocketW 84797->84801 84802 7ffe102550ae PyErr_Format 84798->84802 84810 7ffe102550f2 84798->84810 84803 7ffe10255291 PyErr_Occurred 84799->84803 84804 7ffe102552bc memset getsockname 84799->84804 84807 7ffe102553ca PyEval_RestoreThread 84800->84807 84806 7ffe102553b4 84801->84806 84801->84807 84802->84823 84808 7ffe102552a0 PyErr_SetString 84803->84808 84803->84823 84811 7ffe102552ed 84804->84811 84812 7ffe102552f9 84804->84812 84806->84800 84813 7ffe10255210 84807->84813 84814 7ffe102553dd 84807->84814 84808->84823 84809 7ffe102550e0 84809->84779 84810->84810 84815 7ffe10255156 PySys_Audit 84810->84815 84817 7ffe1025521a 84811->84817 84821 7ffe10255318 getsockopt 84811->84821 84812->84813 84816 7ffe10255302 WSAGetLastError 84812->84816 84829 7ffe10254004 WSAGetLastError PyErr_SetExcFromWindowsErr PyErr_SetFromErrno 84813->84829 84814->84817 84818 7ffe102553ed SetHandleInformation 84814->84818 84819 7ffe102551cf PyEval_SaveThread WSASocketW PyEval_RestoreThread 84815->84819 84815->84823 84816->84811 84816->84813 84817->84823 84830 7ffe10253cc0 6 API calls 84817->84830 84818->84817 84822 7ffe10255405 closesocket PyErr_SetFromWindowsErr 84818->84822 84819->84813 84819->84817 84821->84813 84821->84817 84822->84823 84828 7ffe10252280 8 API calls 2 library calls 84823->84828 84825 7ffe10255268 84825->84823 84826 7ffe10255271 closesocket 84825->84826 84826->84823 84827->84785 84828->84809 84829->84823 84830->84825 84831 7ffe126e26c0 84832 7ffe126e26e4 84831->84832 84833 7ffe126e73ca PyTuple_GetItem 84832->84833 84834 7ffe126e274a 84832->84834 84836 7ffe126e2831 84832->84836 84837 7ffe126e744f 84833->84837 84847 7ffe126e73e2 PyErr_SetString 84833->84847 84901 7ffe126e28f0 14 API calls 84834->84901 84840 7ffe126e27b6 84836->84840 84841 7ffe126e285e 84836->84841 84903 7ffe126e3d98 PyType_IsSubtype 84837->84903 84839 7ffe126e2781 84839->84836 84839->84840 84844 7ffe126e7448 84839->84844 84850 7ffe126e27ad 84839->84850 84866 7ffe126e2980 84840->84866 84849 7ffe126e74e4 _Py_Dealloc 84841->84849 84858 7ffe126e7414 PyErr_Format 84841->84858 84843 7ffe126e745e 84846 7ffe126e7462 PyErr_SetString 84843->84846 84843->84847 84846->84847 84847->84844 84848 7ffe126e27e8 84851 7ffe126e27f9 84848->84851 84855 7ffe126e7500 PyObject_CallFunctionObjArgs 84848->84855 84849->84858 84850->84840 84853 7ffe126e74cf 84850->84853 84902 7ffe126e2894 8 API calls 84851->84902 84853->84858 84863 7ffe126e7404 _Py_Dealloc 84853->84863 84856 7ffe126e7523 84855->84856 84857 7ffe126e7541 84855->84857 84856->84857 84860 7ffe126e7528 84856->84860 84861 7ffe126e7547 _Py_Dealloc 84857->84861 84862 7ffe126e7550 84857->84862 84858->84844 84859 7ffe126e2819 84860->84851 84864 7ffe126e7532 _Py_Dealloc 84860->84864 84861->84862 84862->84859 84865 7ffe126e7556 _Py_Dealloc 84862->84865 84863->84858 84864->84851 84865->84859 84867 7ffe126e29e2 84866->84867 84868 7ffe126e791e 84866->84868 84869 7ffe126e7926 PyErr_Format 84867->84869 84870 7ffe126e29ef 84867->84870 84868->84869 84871 7ffe126e794a 84869->84871 84872 7ffe126e2a16 memset 84870->84872 84873 7ffe126e796d _Py_Dealloc 84871->84873 84872->84871 84884 7ffe126e2a3c 84872->84884 84876 7ffe126e797b 84873->84876 84874 7ffe126e2bea 84882 7ffe126e79ba 84874->84882 84883 7ffe126e2c00 84874->84883 84891 7ffe126e2c1b 84874->84891 84875 7ffe126e2c78 84931 7ffe126e2c90 13 API calls 84875->84931 84932 7ffe126ed498 18 API calls 84876->84932 84878 7ffe126e2a77 PyObject_CallOneArg 84878->84876 84878->84884 84880 7ffe126e7997 84880->84848 84887 7ffe126e79e3 PyLong_FromLong 84882->84887 84888 7ffe126e79c1 84882->84888 84885 7ffe126e2c09 84883->84885 84886 7ffe126e79ce 84883->84886 84884->84871 84884->84873 84884->84875 84884->84876 84884->84878 84898 7ffe126e2ad3 84884->84898 84928 7ffe126e2c90 13 API calls 84884->84928 84929 7ffe126e2600 13 API calls 84885->84929 84886->84887 84893 7ffe126e79d5 PyErr_SetFromWindowsErr 84886->84893 84887->84891 84933 7ffe126ed0a0 21 API calls 84888->84933 84890 7ffe126e2c46 84930 7ffe126e5930 8 API calls 2 library calls 84890->84930 84891->84890 84896 7ffe126e2c36 _Py_Dealloc 84891->84896 84893->84891 84895 7ffe126e2c55 84895->84848 84896->84891 84897 7ffe126e79f1 PyErr_NoMemory 84897->84880 84898->84874 84898->84897 84899 7ffe126e2b84 84898->84899 84899->84874 84904 7ffe126e3bf0 84899->84904 84901->84839 84902->84859 84903->84843 84905 7ffe126e3c3f ffi_prep_cif 84904->84905 84907 7ffe126e3d03 84904->84907 84906 7ffe126e3c62 84905->84906 84905->84907 84906->84907 84910 7ffe126e3c7a 84906->84910 84911 7ffe126e3d41 PyEval_SaveThread 84906->84911 84908 7ffe126e8731 PyErr_SetString 84907->84908 84912 7ffe126e876b _errno _errno 84907->84912 84919 7ffe126e87ff _Py_Dealloc 84907->84919 84920 7ffe126e3d15 84907->84920 84921 7ffe126e880e PySys_Audit 84907->84921 84924 7ffe126e873c PyErr_SetFromWindowsErr 84907->84924 84925 7ffe126e88c6 84907->84925 84926 7ffe126e88a2 PyErr_Format 84907->84926 84927 7ffe126e8890 PyErr_Format 84907->84927 84934 7ffe126ed5f0 12 API calls 84907->84934 84908->84907 84910->84912 84913 7ffe126e8796 GetLastError SetLastError 84910->84913 84914 7ffe126e3ca4 ffi_call 84910->84914 84911->84910 84912->84913 84916 7ffe126e87c1 GetLastError SetLastError 84913->84916 84915 7ffe126e3ce9 84914->84915 84915->84907 84915->84916 84917 7ffe126e87db _errno _errno 84915->84917 84918 7ffe126e3d4f PyEval_RestoreThread 84915->84918 84916->84917 84917->84907 84918->84907 84919->84907 84922 7ffe126e3d24 84920->84922 84923 7ffe126e3d19 PyErr_Occurred 84920->84923 84921->84907 84922->84874 84923->84922 84924->84907 84926->84907 84927->84907 84928->84884 84929->84891 84930->84895 84931->84891 84932->84880 84933->84891 84934->84907

                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                    Function 00007FFE014C18C0 Relevance: 142.0, APIs: 44, Strings: 37, Instructions: 235COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$Constant$Err_$Exception$Eval_ObjectThread$Create2CriticalDeallocFilenameFromInfoInitializeLibraryLoadRestoreSaveSectionStateSystemVersionWindowsWithgetenv
                                                                                                                                                                                                    • String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$PSUTIL_DEBUG$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_VISTA$WINVER$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
                                                                                                                                                                                                    • API String ID: 887074641-2468274236
                                                                                                                                                                                                    • Opcode ID: 87e304a9713b725b37d682548ff580366b52ff8b0698cfc81b6306058a6a7eb8
                                                                                                                                                                                                    • Instruction ID: fae573c0c8f281d0935c461784a132805a8c73d56631ae59db2829de45ee90c1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 87e304a9713b725b37d682548ff580366b52ff8b0698cfc81b6306058a6a7eb8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 23C10764B1CA0681FBA09B12E9953786362EF4ABD2F804035CD0E4FBB4DF6DE149CB01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C1E90 Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 182COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 551 7ffe014c1e90-7ffe014c1eac PyList_New 552 7ffe014c1eb7-7ffe014c1edd 551->552 553 7ffe014c1eae-7ffe014c1eb6 551->553 554 7ffe014c1edf-7ffe014c1eeb 552->554 555 7ffe014c1f3e-7ffe014c1f44 552->555 559 7ffe014c1fcd-7ffe014c1fe4 malloc 554->559 566 7ffe014c1ef1-7ffe014c1ef3 PyErr_SetFromWindowsErr 554->566 556 7ffe014c1f46-7ffe014c1f9c __acrt_iob_func call 7ffe014c1d70 __acrt_iob_func call 7ffe014c1d70 __acrt_iob_func call 7ffe014c1d70 555->556 557 7ffe014c1fa1-7ffe014c1fab 555->557 556->557 557->559 560 7ffe014c1fad-7ffe014c1fc7 PyErr_SetString 557->560 564 7ffe014c1fe6-7ffe014c1fec PyErr_NoMemory 559->564 565 7ffe014c1ff1-7ffe014c200b NtQuerySystemInformation 559->565 560->559 563 7ffe014c1ef9-7ffe014c1efe 560->563 568 7ffe014c1f09-7ffe014c1f0c 563->568 569 7ffe014c1f00-7ffe014c1f03 _Py_Dealloc 563->569 564->563 570 7ffe014c200d-7ffe014c201b call 7ffe014c1350 565->570 571 7ffe014c2020-7ffe014c2023 565->571 566->563 576 7ffe014c1f17-7ffe014c1f3d 568->576 577 7ffe014c1f0e-7ffe014c1f11 free 568->577 569->568 570->563 572 7ffe014c2029-7ffe014c203d 571->572 573 7ffe014c2146-7ffe014c214f free 571->573 578 7ffe014c2040-7ffe014c210c Py_BuildValue 572->578 582 7ffe014c2157-7ffe014c2161 573->582 577->576 578->563 581 7ffe014c2112-7ffe014c2123 PyList_Append 578->581 581->582 583 7ffe014c2125-7ffe014c212c 581->583 582->563 584 7ffe014c2167-7ffe014c2170 _Py_Dealloc 582->584 585 7ffe014c2137-7ffe014c2140 583->585 586 7ffe014c212e-7ffe014c2131 _Py_Dealloc 583->586 584->563 585->573 585->578 586->585
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocErr_FromList_Windowsfree
                                                                                                                                                                                                    • String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
                                                                                                                                                                                                    • API String ID: 2064544276-4027580629
                                                                                                                                                                                                    • Opcode ID: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
                                                                                                                                                                                                    • Instruction ID: 735bf135220c844795c30769687fcac404de9aa85ed42b76a04adf467571af64
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6671C631E18B428AEB969B35A450639A3A5EF95FC4F044336ED4F6A771EF3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4680 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 159COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CallDeallocErr_FunctionObjectObject_ParseTuple
                                                                                                                                                                                                    • String ID: NtQuerySystemInformation$automatically set for PID 0$psutil_pid_is_running -> 0
                                                                                                                                                                                                    • API String ID: 3936211163-1794217337
                                                                                                                                                                                                    • Opcode ID: 78bf41fefa79c4bd70b8d9f9718209f67fd5f00b9064950e924f9d33de70e976
                                                                                                                                                                                                    • Instruction ID: a3ff65d8695a7413d0bcd5aad0fc6469a237c69ec0deb3411164dd39aa404be2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 78bf41fefa79c4bd70b8d9f9718209f67fd5f00b9064950e924f9d33de70e976
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B8617F35F08A8682EB909B56F55517AA3A1FF88BD4F484035DA4D4B778EE2CE545C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7DB0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 128COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorLast$Err_Process__acrt_iob_funcfprintf$FilenameFromOpenTokenWindowsWith$CurrentImpersonateSelfWarn
                                                                                                                                                                                                    • String ID: (originated from %s)$AdjustTokenPrivileges$ImpersonateSelf$LookupPrivilegeValue$OpenProcessToken$SeDebugPrivilege
                                                                                                                                                                                                    • API String ID: 2544101647-3705996988
                                                                                                                                                                                                    • Opcode ID: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
                                                                                                                                                                                                    • Instruction ID: e25464f9af285b4c1e47ee59a6d3398ef0e1a5e4a7f286bcb1267434a0187519
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 46515D72A1CA43C2E7A09F21E8852BA7365FF44795F500436EA8E4A679DF3CE509CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C73F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 69nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: free$malloc$Err_InformationMemoryQuerySystem
                                                                                                                                                                                                    • String ID: NtQuerySystemInformation (no PID found)$NtQuerySystemInformation(SystemProcessInformation)
                                                                                                                                                                                                    • API String ID: 2506067127-1914444273
                                                                                                                                                                                                    • Opcode ID: abc331c25d0d3c4f460188446cf89990b0c9f43cd66563d27ecfb05579b7593b
                                                                                                                                                                                                    • Instruction ID: 2861b8c81a2ee0d7e60bec459b994c638065ec0675c648603460a516d3e13abe
                                                                                                                                                                                                    • Opcode Fuzzy Hash: abc331c25d0d3c4f460188446cf89990b0c9f43cd66563d27ecfb05579b7593b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3D311C31A0974282EB949F15A854639BBA0FF89B85F144435EA8E8B774DF3DE841CB04
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE102545E4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48threadnetworkCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1910216886.00007FFE10251000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10250000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910106258.00007FFE10250000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910283693.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910340707.00007FFE10260000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910368355.00007FFE10262000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe10250000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Thread$AuditErr_FormatRestoreSaveSys_bind
                                                                                                                                                                                                    • String ID: bind$socket.bind
                                                                                                                                                                                                    • API String ID: 1695574521-187351271
                                                                                                                                                                                                    • Opcode ID: c50005ba011be0fc7b1b92de6c21679af7c64db85adc767407b4e31c8a78c957
                                                                                                                                                                                                    • Instruction ID: 12c5b6d8957dd1a56112e8a26fc8c2635cc56e2c5404138b36bda547b3fd2041
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c50005ba011be0fc7b1b92de6c21679af7c64db85adc767407b4e31c8a78c957
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 52110BA1A08F8281E6209B52E4403EAA764FBC9BA4F440172DB4D57B66FFBCE545C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0E171660 Relevance: 179.6, APIs: 101, Strings: 1, Instructions: 1106COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyImport_Import.PYTHON311(?,?,?,?,?,?,00000000,?,?,00000000,00007FFE0E168A49), ref: 00007FFE0E171680
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,?,00000000,00007FFE0E168A49), ref: 00007FFE0E1716A9
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,?,00000000,00007FFE0E168A49), ref: 00007FFE0E1716EF
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908054902.00007FFE0E161000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFE0E160000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1907960824.00007FFE0E160000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908135451.00007FFE0E174000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908191150.00007FFE0E17A000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908276424.00007FFE0E17E000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0e160000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ImportImport_
                                                                                                                                                                                                    • String ID: <module>
                                                                                                                                                                                                    • API String ID: 2397823689-217463007
                                                                                                                                                                                                    • Opcode ID: 31361185dd40eca64a4d0713cd9bf962043c8a4a799bfca1e9d897335efbc7c7
                                                                                                                                                                                                    • Instruction ID: 90da5e6b28130c026a6b40b0af705a48e7a3626ef02f1345b868cc8cd6fd6bcb
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 31361185dd40eca64a4d0713cd9bf962043c8a4a799bfca1e9d897335efbc7c7
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3DC2F0A5A0AB0B81EA119B65F8901B823B5BF8AF94F44403BC9DE17375EF3CA595C341
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C13D0 Relevance: 89.5, APIs: 27, Strings: 24, Instructions: 229libraryloaderthreadCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 337 7ffe014c13d0-7ffe014c13ff PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 338 7ffe014c1401-7ffe014c1410 PyErr_SetFromWindowsErrWithFilename 337->338 339 7ffe014c1412-7ffe014c1425 GetProcAddress 337->339 340 7ffe014c143f-7ffe014c1441 338->340 341 7ffe014c1458-7ffe014c146f GetModuleHandleA 339->341 342 7ffe014c1427-7ffe014c1439 PyErr_SetFromWindowsErrWithFilename FreeLibrary 339->342 343 7ffe014c1448-7ffe014c1457 340->343 344 7ffe014c147a-7ffe014c148d GetProcAddress 341->344 345 7ffe014c1471-7ffe014c1478 341->345 342->340 347 7ffe014c14b7-7ffe014c14ce GetModuleHandleA 344->347 348 7ffe014c148f 344->348 346 7ffe014c1496-7ffe014c14b6 PyErr_SetFromWindowsErrWithFilename 345->346 349 7ffe014c14d9-7ffe014c14ec GetProcAddress 347->349 350 7ffe014c14d0-7ffe014c14d7 347->350 348->346 352 7ffe014c1516-7ffe014c1542 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 349->352 353 7ffe014c14ee 349->353 351 7ffe014c14f5-7ffe014c1515 PyErr_SetFromWindowsErrWithFilename 350->351 354 7ffe014c156a-7ffe014c157d GetProcAddress 352->354 355 7ffe014c1544-7ffe014c1569 PyErr_SetFromWindowsErrWithFilename 352->355 353->351 356 7ffe014c15b0-7ffe014c15d4 call 7ffe014c12c0 354->356 357 7ffe014c157f-7ffe014c15af PyErr_SetFromWindowsErrWithFilename FreeLibrary 354->357 356->343 360 7ffe014c15da-7ffe014c15f7 call 7ffe014c12c0 356->360 360->343 363 7ffe014c15fd-7ffe014c161a call 7ffe014c12c0 360->363 363->343 366 7ffe014c1620-7ffe014c163d call 7ffe014c12c0 363->366 366->343 369 7ffe014c1643-7ffe014c1660 call 7ffe014c12c0 366->369 369->343 372 7ffe014c1666-7ffe014c1683 call 7ffe014c12c0 369->372 372->343 375 7ffe014c1689-7ffe014c16a6 call 7ffe014c12c0 372->375 375->343 378 7ffe014c16ac-7ffe014c16c9 call 7ffe014c12c0 375->378 378->343 381 7ffe014c16cf-7ffe014c16df GetModuleHandleA 378->381 382 7ffe014c16ea-7ffe014c16fd GetProcAddress 381->382 383 7ffe014c16e1-7ffe014c16e8 381->383 385 7ffe014c1727-7ffe014c174b call 7ffe014c12c0 382->385 386 7ffe014c16ff 382->386 384 7ffe014c1706-7ffe014c1726 PyErr_SetFromWindowsErrWithFilename 383->384 385->343 389 7ffe014c1751-7ffe014c1761 GetModuleHandleA 385->389 386->384 390 7ffe014c176c-7ffe014c177f GetProcAddress 389->390 391 7ffe014c1763-7ffe014c176a 389->391 393 7ffe014c1781 390->393 394 7ffe014c1792-7ffe014c17c1 call 7ffe014c12c0 * 2 390->394 392 7ffe014c1788-7ffe014c1790 PyErr_SetFromWindowsErrWithFilename 391->392 392->394 393->392 398 7ffe014c17c6-7ffe014c1813 call 7ffe014c12c0 * 2 PyErr_Clear 394->398
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_FilenameFromWindowsWith$AddressEval_LibraryProcThread$FreeHandleLoadModuleRestoreSave
                                                                                                                                                                                                    • String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WTSEnumerateSessionsW$WTSFreeMemory$WTSQuerySessionInformationW$iphlpapi.dll$kernel32$ntdll$ntdll.dll$wtsapi32.dll
                                                                                                                                                                                                    • API String ID: 3787047288-761253638
                                                                                                                                                                                                    • Opcode ID: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
                                                                                                                                                                                                    • Instruction ID: 93c436d6b490e08a1c6337bc3e0525bf59de2d1a943f1e733145b5f123752c4f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E6C1DF64A0AB07C0FFC49B24E8961B963A5FF48B85F885439D84E4F2B5EF6CE5488314
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C79B0 Relevance: 61.4, APIs: 25, Strings: 10, Instructions: 141COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C79CD
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C79F1
                                                                                                                                                                                                    • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C7A17
                                                                                                                                                                                                    • fprintf.MSPDB140-MSVCRT ref: 00007FFE014C7A34
                                                                                                                                                                                                    • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C7A3E
                                                                                                                                                                                                    • fprintf.MSPDB140-MSVCRT ref: 00007FFE014C7A4E
                                                                                                                                                                                                    • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C7A58
                                                                                                                                                                                                    • fprintf.MSPDB140-MSVCRT ref: 00007FFE014C7A68
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C10E0: PyObject_CallFunction.PYTHON3 ref: 00007FFE014C112B
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C10E0: PyErr_SetObject.PYTHON3 ref: 00007FFE014C1141
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C10E0: _Py_Dealloc.PYTHON3 ref: 00007FFE014C1155
                                                                                                                                                                                                    • GetExitCodeProcess.KERNEL32 ref: 00007FFE014C7B21
                                                                                                                                                                                                    • CloseHandle.KERNEL32 ref: 00007FFE014C7B4C
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_funcfprintf$ErrorLast$CallCloseCodeDeallocErr_ExitFunctionHandleObjectObject_Process
                                                                                                                                                                                                    • String ID: GetExitCodeProcess$GetExitCodeProcess != STILL_ACTIVE$GetExitCodeProcess -> ERROR_ACCESS_DENIED (ignored)$OpenProcess$OpenProcess -> ERROR_INVALID_PARAMETER$OpenProcess -> ERROR_SUCCESS$OpenProcess -> ERROR_SUCCESS turned into AD$OpenProcess -> ERROR_SUCCESS turned into NSP$psutil-debug [%s:%d]> $psutil/arch/windows\proc_utils.c
                                                                                                                                                                                                    • API String ID: 2708412498-404906942
                                                                                                                                                                                                    • Opcode ID: 721519ab73ea6751cd9850acc7ecbdb50b44b880d030467dd18bc62799fe5bca
                                                                                                                                                                                                    • Instruction ID: 20c5d975d05042f996c2cdef3fceef44670c494aa012c9183e366fb4b6426e48
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 721519ab73ea6751cd9850acc7ecbdb50b44b880d030467dd18bc62799fe5bca
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E1510171F1C94292FBD4AB65ECD62B92261EF84BD1F440136D90E4E2B6EE2CE985C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE126E3BF0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 181threadCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 456 7ffe126e3bf0-7ffe126e3c39 457 7ffe126e870a-7ffe126e8711 456->457 458 7ffe126e3c3f-7ffe126e3c5c ffi_prep_cif 456->458 461 7ffe126e871a-7ffe126e8721 457->461 459 7ffe126e3c62-7ffe126e3c65 458->459 460 7ffe126e8713 458->460 462 7ffe126e3c6b-7ffe126e3c74 459->462 463 7ffe126e874f-7ffe126e8764 call 7ffe126ed5f0 459->463 460->461 464 7ffe126e8731-7ffe126e873a PyErr_SetString 461->464 466 7ffe126e3c7a-7ffe126e3c8e 462->466 467 7ffe126e3d41-7ffe126e3d4a PyEval_SaveThread 462->467 468 7ffe126e8745 463->468 472 7ffe126e8766 463->472 464->468 470 7ffe126e876b-7ffe126e8789 _errno * 2 466->470 471 7ffe126e3c94-7ffe126e3c9e 466->471 467->466 468->463 473 7ffe126e8796-7ffe126e87b4 GetLastError SetLastError 470->473 471->473 474 7ffe126e3ca4-7ffe126e3cc5 ffi_call 471->474 472->470 476 7ffe126e87c1-7ffe126e87d5 GetLastError SetLastError 473->476 475 7ffe126e3ce9-7ffe126e3cf0 474->475 475->476 477 7ffe126e3cf6-7ffe126e3cf9 475->477 478 7ffe126e87db-7ffe126e87ed _errno * 2 476->478 477->478 479 7ffe126e3cff-7ffe126e3d01 477->479 483 7ffe126e87f4-7ffe126e87f9 478->483 480 7ffe126e3d03-7ffe126e3d06 479->480 481 7ffe126e3d4f-7ffe126e3d58 PyEval_RestoreThread 479->481 482 7ffe126e3d0c-7ffe126e3d0f 480->482 480->483 481->480 485 7ffe126e3d15-7ffe126e3d17 482->485 486 7ffe126e880e-7ffe126e8827 PySys_Audit 482->486 483->482 484 7ffe126e87ff-7ffe126e8809 _Py_Dealloc 483->484 484->482 488 7ffe126e3d5a-7ffe126e3d5c 485->488 489 7ffe126e3d19-7ffe126e3d22 PyErr_Occurred 485->489 486->468 487 7ffe126e882d-7ffe126e8834 486->487 490 7ffe126e8836 487->490 491 7ffe126e88b4-7ffe126e88c0 487->491 492 7ffe126e3d24-7ffe126e3d40 488->492 489->492 493 7ffe126e8838-7ffe126e883f 490->493 494 7ffe126e8873-7ffe126e888e 490->494 495 7ffe126e873c-7ffe126e873f PyErr_SetFromWindowsErr 491->495 496 7ffe126e88c6-7ffe126e88dc 491->496 497 7ffe126e8867 493->497 498 7ffe126e8841-7ffe126e8848 493->498 499 7ffe126e88a2-7ffe126e88af PyErr_Format 494->499 500 7ffe126e8890-7ffe126e889d PyErr_Format 494->500 495->468 497->494 501 7ffe126e8723 498->501 502 7ffe126e884e-7ffe126e8855 498->502 499->468 500->468 504 7ffe126e872a 501->504 502->495 503 7ffe126e885b-7ffe126e8862 502->503 503->504 504->464
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911159608.00007FFE126E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE126E0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911134066.00007FFE126E0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911210251.00007FFE126F0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911243230.00007FFE126F7000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911282295.00007FFE126FB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe126e0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$_errno$Eval_FromOccurredSaveStringThreadWindowsffi_callffi_prep_cif
                                                                                                                                                                                                    • String ID: No ffi_type for result$ctypes.seh_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
                                                                                                                                                                                                    • API String ID: 1937973484-2749438402
                                                                                                                                                                                                    • Opcode ID: 4b6dc3c35d84d992ba9a2cb10c7ebabb941dcd470c99c216c65d26d0d4dff296
                                                                                                                                                                                                    • Instruction ID: 5017bccf611c7e8400bad3ac2c0be4a923c5ba47c93e8896bb39458970030c70
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4b6dc3c35d84d992ba9a2cb10c7ebabb941dcd470c99c216c65d26d0d4dff296
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0C812972A1CE8282EB60CB12EC552BD67A5FB84BA4F1050B5D94E436F8DFBCE8558704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE10255008 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 247threadnetworkCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 505 7ffe10255008-7ffe10255042 506 7ffe10255044-7ffe1025504e 505->506 507 7ffe10255050-7ffe10255075 PySys_Audit 505->507 506->507 510 7ffe10255090-7ffe1025509e 506->510 508 7ffe102550cb 507->508 509 7ffe10255077-7ffe1025507a 507->509 515 7ffe102550d0-7ffe102550f1 call 7ffe10252280 508->515 511 7ffe10255080-7ffe1025508a 509->511 512 7ffe10255357-7ffe10255394 PyEval_SaveThread 509->512 513 7ffe102550a4-7ffe102550ac 510->513 514 7ffe1025527f-7ffe1025528f PyLong_AsLongLong 510->514 511->510 511->512 516 7ffe102553c1-7ffe102553c7 socket 512->516 517 7ffe10255396-7ffe102553b2 WSASocketW 512->517 518 7ffe102550f2-7ffe102550fb 513->518 519 7ffe102550ae-7ffe102550c5 PyErr_Format 513->519 520 7ffe10255291-7ffe1025529a PyErr_Occurred 514->520 521 7ffe102552bc-7ffe102552eb memset getsockname 514->521 524 7ffe102553ca-7ffe102553d7 PyEval_RestoreThread 516->524 523 7ffe102553b4-7ffe102553bf 517->523 517->524 527 7ffe10255103-7ffe10255154 518->527 519->508 520->508 525 7ffe102552a0-7ffe102552b7 PyErr_SetString 520->525 528 7ffe102552ed-7ffe102552f0 521->528 529 7ffe102552f9-7ffe102552fc 521->529 523->516 530 7ffe10255210-7ffe10255215 call 7ffe10254004 524->530 531 7ffe102553dd-7ffe102553e7 524->531 525->508 527->527 532 7ffe10255156-7ffe102551c9 PySys_Audit 527->532 533 7ffe102552f2-7ffe102552f7 528->533 534 7ffe10255313-7ffe10255316 528->534 529->530 535 7ffe10255302-7ffe1025530d WSAGetLastError 529->535 530->508 536 7ffe1025522f-7ffe10255258 531->536 537 7ffe102553ed-7ffe102553ff SetHandleInformation 531->537 532->508 538 7ffe102551cf-7ffe1025520e PyEval_SaveThread WSASocketW PyEval_RestoreThread 532->538 533->534 540 7ffe10255350-7ffe10255352 534->540 541 7ffe10255318-7ffe10255346 getsockopt 534->541 535->530 535->534 543 7ffe1025525e-7ffe1025526b call 7ffe10253cc0 536->543 544 7ffe1025541b-7ffe1025541d 536->544 537->536 545 7ffe10255405-7ffe10255416 closesocket PyErr_SetFromWindowsErr 537->545 538->530 546 7ffe1025521a-7ffe10255228 538->546 540->536 541->530 542 7ffe1025534c 541->542 542->540 543->544 550 7ffe10255271-7ffe1025527a closesocket 543->550 544->515 545->508 546->536 550->508
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1910216886.00007FFE10251000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10250000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910106258.00007FFE10250000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910283693.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910340707.00007FFE10260000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910368355.00007FFE10262000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe10250000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_closesocket$ErrorFormatFromHandleInformationLastLong_OccurredStringWindowsgetsocknamegetsockoptmemsetsocket
                                                                                                                                                                                                    • String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
                                                                                                                                                                                                    • API String ID: 2694513709-2881308447
                                                                                                                                                                                                    • Opcode ID: a64462efc10c0ea6d01849caac0aca0070278d80b0bdb69957ff614c14402a3c
                                                                                                                                                                                                    • Instruction ID: 8dc0efdaf113d938c12693b5fac6de4a175b64061a08f976e4316f42fa886616
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a64462efc10c0ea6d01849caac0aca0070278d80b0bdb69957ff614c14402a3c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3CC1AF61A18E8182E6208B2A94542B97BA0FBC9BB4F105375DF5D437B2FF7CE585C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB41170 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 139COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 624 7ffe0eb41170-7ffe0eb411a1 PyModule_GetState PyDict_New 625 7ffe0eb41341-7ffe0eb41346 624->625 626 7ffe0eb411a7-7ffe0eb411b4 PyDict_New 624->626 627 7ffe0eb41328-7ffe0eb41340 625->627 626->625 628 7ffe0eb411ba-7ffe0eb411c7 PyDict_New 626->628 628->625 629 7ffe0eb411cd-7ffe0eb411d7 628->629 630 7ffe0eb4126f-7ffe0eb4127e 629->630 631 7ffe0eb411dd 629->631 633 7ffe0eb412e0-7ffe0eb412f6 PyModule_AddObjectRef 630->633 634 7ffe0eb41280-7ffe0eb4129b PyLong_FromLong PyUnicode_FromString 630->634 632 7ffe0eb411e4-7ffe0eb411f3 PyUnicode_FromString 631->632 632->625 636 7ffe0eb411f9-7ffe0eb41212 _Py_BuildValue_SizeT 632->636 633->625 635 7ffe0eb412f8-7ffe0eb4130e PyModule_AddObjectRef 633->635 634->625 637 7ffe0eb412a1-7ffe0eb412a4 634->637 635->625 638 7ffe0eb41310-7ffe0eb41326 PyModule_AddObjectRef 635->638 639 7ffe0eb43565-7ffe0eb43569 636->639 640 7ffe0eb41218-7ffe0eb4122a PyDict_SetItem 636->640 637->625 641 7ffe0eb412aa-7ffe0eb412bc PyDict_SetItem 637->641 638->627 639->625 644 7ffe0eb4356f-7ffe0eb43579 _Py_Dealloc 639->644 642 7ffe0eb41230-7ffe0eb41246 PyDict_SetItem 640->642 643 7ffe0eb43556-7ffe0eb4355a 640->643 641->625 645 7ffe0eb412c2-7ffe0eb412c6 641->645 646 7ffe0eb43538-7ffe0eb43541 _Py_Dealloc 642->646 647 7ffe0eb4124c-7ffe0eb41250 642->647 643->639 648 7ffe0eb4355c-7ffe0eb4355f _Py_Dealloc 643->648 644->625 649 7ffe0eb4357e-7ffe0eb43587 _Py_Dealloc 645->649 650 7ffe0eb412cc-7ffe0eb412d0 645->650 651 7ffe0eb43547-7ffe0eb43550 _Py_Dealloc 646->651 647->651 652 7ffe0eb41256-7ffe0eb41258 647->652 648->639 654 7ffe0eb4358d-7ffe0eb43596 _Py_Dealloc 649->654 653 7ffe0eb412d6-7ffe0eb412de 650->653 650->654 651->643 652->625 655 7ffe0eb4125e-7ffe0eb41269 652->655 653->633 653->634 655->630 655->632
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dict_$Dealloc$Module_$FromItemObject$StringUnicode_$BuildLongLong_SizeStateValue_
                                                                                                                                                                                                    • String ID: err_codes_to_names$err_names_to_codes$lib_codes_to_names
                                                                                                                                                                                                    • API String ID: 311900024-3898622116
                                                                                                                                                                                                    • Opcode ID: c6e60629ece7d000aa113861ff06567cd8a9fb5c02c61e9550bf6cae00e17cd4
                                                                                                                                                                                                    • Instruction ID: 54cc791a1873f9653133b242a0bbf592b8e14018f8a9821b3a6551233eb629ee
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c6e60629ece7d000aa113861ff06567cd8a9fb5c02c61e9550bf6cae00e17cd4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: EE51E7B1E0EB1792FA359F6AA91423823E4EF45B95F084435CE8D56B74EF3CE4858B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB41E64 Relevance: 31.7, APIs: 21, Instructions: 181COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 696 7ffe0eb41e64-7ffe0eb41e8b PyModule_GetState 698 7ffe0eb41e8d-7ffe0eb41e94 696->698 699 7ffe0eb41e9a-7ffe0eb41ea1 696->699 698->699 700 7ffe0eb436ec-7ffe0eb436f3 _Py_Dealloc 698->700 701 7ffe0eb41eb1-7ffe0eb41eb8 699->701 702 7ffe0eb41ea3-7ffe0eb41eab 699->702 700->699 704 7ffe0eb41ec8-7ffe0eb41ecf 701->704 705 7ffe0eb41eba-7ffe0eb41ec2 701->705 702->701 703 7ffe0eb436f8-7ffe0eb436ff _Py_Dealloc 702->703 703->701 707 7ffe0eb41ed1-7ffe0eb41ed9 704->707 708 7ffe0eb41edf-7ffe0eb41ee6 704->708 705->704 706 7ffe0eb43704-7ffe0eb4370b _Py_Dealloc 705->706 706->704 707->708 709 7ffe0eb43710-7ffe0eb43717 _Py_Dealloc 707->709 710 7ffe0eb41ee8-7ffe0eb41ef0 708->710 711 7ffe0eb41ef6-7ffe0eb41efd 708->711 709->708 710->711 712 7ffe0eb4371c-7ffe0eb43723 _Py_Dealloc 710->712 713 7ffe0eb41eff-7ffe0eb41f07 711->713 714 7ffe0eb41f0d-7ffe0eb41f14 711->714 712->711 713->714 715 7ffe0eb43728-7ffe0eb4372f _Py_Dealloc 713->715 716 7ffe0eb41f24-7ffe0eb41f2b 714->716 717 7ffe0eb41f16-7ffe0eb41f1e 714->717 715->714 719 7ffe0eb41f2d-7ffe0eb41f35 716->719 720 7ffe0eb41f3b-7ffe0eb41f42 716->720 717->716 718 7ffe0eb43734-7ffe0eb4373b _Py_Dealloc 717->718 718->716 719->720 721 7ffe0eb43740-7ffe0eb43747 _Py_Dealloc 719->721 722 7ffe0eb41f44-7ffe0eb41f4c 720->722 723 7ffe0eb41f52-7ffe0eb41f59 720->723 721->720 722->723 724 7ffe0eb4374c-7ffe0eb43753 _Py_Dealloc 722->724 725 7ffe0eb41f69-7ffe0eb41f70 723->725 726 7ffe0eb41f5b-7ffe0eb41f63 723->726 724->723 728 7ffe0eb41f80-7ffe0eb41f87 725->728 729 7ffe0eb41f72-7ffe0eb41f7a 725->729 726->725 727 7ffe0eb43758-7ffe0eb4375f _Py_Dealloc 726->727 727->725 731 7ffe0eb41f89-7ffe0eb41f91 728->731 732 7ffe0eb41f97-7ffe0eb41f9e 728->732 729->728 730 7ffe0eb43764-7ffe0eb4376b _Py_Dealloc 729->730 730->728 731->732 733 7ffe0eb43770-7ffe0eb43777 _Py_Dealloc 731->733 734 7ffe0eb41fb0-7ffe0eb41fb7 732->734 735 7ffe0eb41fa0-7ffe0eb41fa8 732->735 733->732 737 7ffe0eb41fc9-7ffe0eb41fd0 734->737 738 7ffe0eb41fb9-7ffe0eb41fc1 734->738 735->734 736 7ffe0eb41faa _Py_Dealloc 735->736 736->734 740 7ffe0eb41fe2-7ffe0eb41fe9 737->740 741 7ffe0eb41fd2-7ffe0eb41fda 737->741 738->737 739 7ffe0eb41fc3 _Py_Dealloc 738->739 739->737 743 7ffe0eb41ff9-7ffe0eb42003 740->743 744 7ffe0eb41feb-7ffe0eb41ff3 740->744 741->740 742 7ffe0eb41fdc _Py_Dealloc 741->742 742->740 746 7ffe0eb42005-7ffe0eb42010 743->746 747 7ffe0eb42016-7ffe0eb42020 743->747 744->743 745 7ffe0eb4377c-7ffe0eb43783 _Py_Dealloc 744->745 745->743 746->747 750 7ffe0eb43788-7ffe0eb4378f _Py_Dealloc 746->750 748 7ffe0eb4202f-7ffe0eb42039 747->748 749 7ffe0eb42022-7ffe0eb4202d 747->749 752 7ffe0eb4204e-7ffe0eb42058 748->752 753 7ffe0eb4203b-7ffe0eb42046 748->753 749->748 751 7ffe0eb4207a-7ffe0eb42080 _Py_Dealloc 749->751 750->747 751->748 755 7ffe0eb4206d-7ffe0eb42079 752->755 756 7ffe0eb4205a-7ffe0eb42065 752->756 753->752 754 7ffe0eb42048 _Py_Dealloc 753->754 754->752 756->755 757 7ffe0eb42067 _Py_Dealloc 756->757 757->755
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Module_State
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3434497292-0
                                                                                                                                                                                                    • Opcode ID: f1da567e134593277256ef6c3e95c8f78a145cb8c4559d5b4235226dbf4ce70b
                                                                                                                                                                                                    • Instruction ID: 33af0756b7a619d16d26b6467da4a4b695494aef9a261dbb5edd19953a3a9af8
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f1da567e134593277256ef6c3e95c8f78a145cb8c4559d5b4235226dbf4ce70b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0581A8B6E0EB4281EB798F78995413833E8EF45B55F188534CACE06A74CF2DE881DB51
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0E168970 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 144COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 758 7ffe0e168970-7ffe0e168988 759 7ffe0e16898a-7ffe0e168997 758->759 760 7ffe0e168998-7ffe0e1689b4 PyModule_Create2 758->760 761 7ffe0e168a90-7ffe0e168a93 760->761 762 7ffe0e1689ba-7ffe0e1689e4 PyObject_GetAttrString PyModule_GetDict 760->762 763 7ffe0e168aa4-7ffe0e168aae 761->763 764 7ffe0e168a95-7ffe0e168a99 761->764 765 7ffe0e168a6e-7ffe0e168a78 762->765 766 7ffe0e1689ea-7ffe0e1689f0 762->766 771 7ffe0e168ac3-7ffe0e168acd 763->771 772 7ffe0e168ab0-7ffe0e168abb 763->772 764->763 768 7ffe0e168a9b-7ffe0e168a9e _Py_Dealloc 764->768 765->761 767 7ffe0e168a7a-7ffe0e168a85 765->767 769 7ffe0e168a44 call 7ffe0e171660 766->769 770 7ffe0e1689f2-7ffe0e168a38 call 7ffe0e164080 766->770 767->761 774 7ffe0e168a87-7ffe0e168a8a _Py_Dealloc 767->774 768->763 780 7ffe0e168a49-7ffe0e168a4b 769->780 770->765 788 7ffe0e168a3a 770->788 777 7ffe0e168ae2-7ffe0e168aec 771->777 778 7ffe0e168acf-7ffe0e168ada 771->778 772->771 776 7ffe0e168abd _Py_Dealloc 772->776 774->761 776->771 781 7ffe0e168b01-7ffe0e168b0b 777->781 782 7ffe0e168aee-7ffe0e168af9 777->782 778->777 779 7ffe0e168adc _Py_Dealloc 778->779 779->777 780->765 784 7ffe0e168a4d-7ffe0e168a51 780->784 786 7ffe0e168b20-7ffe0e168b2a 781->786 787 7ffe0e168b0d-7ffe0e168b18 781->787 782->781 785 7ffe0e168afb _Py_Dealloc 782->785 789 7ffe0e168a53-7ffe0e168a56 _Py_Dealloc 784->789 790 7ffe0e168a5c-7ffe0e168a6d 784->790 785->781 792 7ffe0e168b3f-7ffe0e168b49 786->792 793 7ffe0e168b2c-7ffe0e168b37 786->793 787->786 791 7ffe0e168b1a _Py_Dealloc 787->791 788->769 789->790 791->786 795 7ffe0e168b5e-7ffe0e168b68 792->795 796 7ffe0e168b4b-7ffe0e168b56 792->796 793->792 794 7ffe0e168b39 _Py_Dealloc 793->794 794->792 798 7ffe0e168b7d-7ffe0e168b87 795->798 799 7ffe0e168b6a-7ffe0e168b75 795->799 796->795 797 7ffe0e168b58 _Py_Dealloc 796->797 797->795 800 7ffe0e168b9c-7ffe0e168ba6 798->800 801 7ffe0e168b89-7ffe0e168b94 798->801 799->798 802 7ffe0e168b77 _Py_Dealloc 799->802 804 7ffe0e168bbb-7ffe0e168bc5 800->804 805 7ffe0e168ba8-7ffe0e168bb3 800->805 801->800 803 7ffe0e168b96 _Py_Dealloc 801->803 802->798 803->800 807 7ffe0e168bda-7ffe0e168be6 804->807 808 7ffe0e168bc7-7ffe0e168bd2 804->808 805->804 806 7ffe0e168bb5 _Py_Dealloc 805->806 806->804 808->807 809 7ffe0e168bd4 _Py_Dealloc 808->809 809->807
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908054902.00007FFE0E161000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFE0E160000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1907960824.00007FFE0E160000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908135451.00007FFE0E174000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908191150.00007FFE0E17A000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908276424.00007FFE0E17E000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0e160000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$AttrCreate2DeallocDictObject_String
                                                                                                                                                                                                    • String ID: __name__
                                                                                                                                                                                                    • API String ID: 2272293537-3954359393
                                                                                                                                                                                                    • Opcode ID: 4f397e03f3fee52b4d0ecdc321c4dbf54df67c5ae79e314d5e53c94f376fe017
                                                                                                                                                                                                    • Instruction ID: edfb2083ff24b31b502ba73481d616b2c74f63ea31cbfea98a285b353eeacace
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4f397e03f3fee52b4d0ecdc321c4dbf54df67c5ae79e314d5e53c94f376fe017
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E571C075E0AB0B81FA598B64B99413833B4BF8AF94F184537C9DE02671DF3DA4908311
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0E1644D0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908054902.00007FFE0E161000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFE0E160000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1907960824.00007FFE0E160000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908135451.00007FFE0E174000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908191150.00007FFE0E17A000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908276424.00007FFE0E17E000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0e160000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
                                                                                                                                                                                                    • String ID: %U.%U$cannot import name %R from %R (%S)
                                                                                                                                                                                                    • API String ID: 3630264407-438398067
                                                                                                                                                                                                    • Opcode ID: e640b3e46d7a37767e1cf98e302e0e9caccce58bf8976f823c6c11df13f9ec8d
                                                                                                                                                                                                    • Instruction ID: 82ddcb3ed7c9f516bb6a3472385eec89df2e700a771b6d0d21858bbb37423171
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e640b3e46d7a37767e1cf98e302e0e9caccce58bf8976f823c6c11df13f9ec8d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1E417C66A09A5385EA249B66B84427DA3B0BB49FC4F088136CEEE07775EF3CE4558340
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE126E26C0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 191COMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                    control_flow_graph 835 7ffe126e26c0-7ffe126e26f7 call 7ffe126e2870 838 7ffe126e26fd-7ffe126e2704 835->838 839 7ffe126e2831 835->839 840 7ffe126e270a-7ffe126e2714 838->840 841 7ffe126e283d 838->841 839->841 842 7ffe126e271d-7ffe126e2724 840->842 843 7ffe126e2716 840->843 845 7ffe126e2849 841->845 844 7ffe126e272a-7ffe126e2744 842->844 842->845 843->842 846 7ffe126e73ca-7ffe126e73e0 PyTuple_GetItem 844->846 847 7ffe126e274a-7ffe126e2787 call 7ffe126e28f0 844->847 849 7ffe126e2855-7ffe126e2858 845->849 850 7ffe126e73e2-7ffe126e73e9 846->850 851 7ffe126e744f-7ffe126e7460 call 7ffe126e3d98 846->851 858 7ffe126e278d-7ffe126e2790 847->858 859 7ffe126e7448-7ffe126e744a 847->859 854 7ffe126e27b6-7ffe126e27e3 call 7ffe126e2980 849->854 855 7ffe126e285e-7ffe126e74e2 849->855 856 7ffe126e73f2-7ffe126e7402 PyErr_SetString 850->856 862 7ffe126e7462-7ffe126e7479 PyErr_SetString 851->862 863 7ffe126e7480-7ffe126e748f 851->863 865 7ffe126e27e8-7ffe126e27ee 854->865 866 7ffe126e74f4-7ffe126e74fb 855->866 867 7ffe126e74e4-7ffe126e74ed _Py_Dealloc 855->867 856->859 858->854 864 7ffe126e2792-7ffe126e27a7 858->864 862->863 868 7ffe126e74c3-7ffe126e74ca 863->868 869 7ffe126e7491-7ffe126e749c 863->869 864->849 870 7ffe126e27ad-7ffe126e27b0 864->870 871 7ffe126e27f9-7ffe126e2814 call 7ffe126e2894 865->871 872 7ffe126e27f0-7ffe126e27f3 865->872 873 7ffe126e741b-7ffe126e7442 PyErr_Format 866->873 867->866 868->856 869->868 874 7ffe126e749e-7ffe126e74a4 869->874 870->854 875 7ffe126e74cf-7ffe126e74d3 870->875 884 7ffe126e2819-7ffe126e2830 871->884 872->871 877 7ffe126e7500-7ffe126e7521 PyObject_CallFunctionObjArgs 872->877 873->859 880 7ffe126e73eb 874->880 881 7ffe126e74aa-7ffe126e74b9 874->881 882 7ffe126e74d9 _Py_Dealloc 875->882 883 7ffe126e7414 875->883 878 7ffe126e7523-7ffe126e7526 877->878 879 7ffe126e7541-7ffe126e7545 877->879 878->879 885 7ffe126e7528-7ffe126e752c 878->885 886 7ffe126e7547-7ffe126e754a _Py_Dealloc 879->886 887 7ffe126e7550-7ffe126e7554 879->887 880->856 881->868 882->883 883->873 885->871 889 7ffe126e7532-7ffe126e753c _Py_Dealloc 885->889 886->887 890 7ffe126e7556-7ffe126e7559 _Py_Dealloc 887->890 891 7ffe126e755f-7ffe126e7562 887->891 889->871 890->891 891->884
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911159608.00007FFE126E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE126E0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911134066.00007FFE126E0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911210251.00007FFE126F0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911243230.00007FFE126F7000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911282295.00007FFE126FB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe126e0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID: COM method call without VTable$Expected a COM this pointer as first argument$NULL COM pointer access$native com method call without 'this' parameter$this function takes %d argument%s (%d given)$this function takes at least %d argument%s (%d given)
                                                                                                                                                                                                    • API String ID: 0-1981512665
                                                                                                                                                                                                    • Opcode ID: f07b7bceabcce526c4a62d906a5ec0dd6d9bc262e596e910abc21d3a49bdda52
                                                                                                                                                                                                    • Instruction ID: d24570354766e02c3c4ddb0c28c9ba85d78c41c96de4a4fd0a39d9f5f2fcb990
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f07b7bceabcce526c4a62d906a5ec0dd6d9bc262e596e910abc21d3a49bdda52
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 84912536A09F4285EF65CB26A8502BA67A1FB84BA4F5440B5DE4D077E8EFBCE445C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C44B0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 114timeCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_ErrorHandleLastProcess$Arg_CallDeallocFromFunctionObjectObject_OpenParseTimesTupleWindows
                                                                                                                                                                                                    • String ID: (ddd)$GetProcessTimes -> ERROR_ACCESS_DENIED$OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 935190873-3215740380
                                                                                                                                                                                                    • Opcode ID: a6529f4dca2b323f70df027287471ec8859894a8df051b1a19f176af9b6aee91
                                                                                                                                                                                                    • Instruction ID: 491e771dfcb4c87b7378f6c3043fa0a0682f5faaf1a0f9765825cc201168cd84
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a6529f4dca2b323f70df027287471ec8859894a8df051b1a19f176af9b6aee91
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1741C771F1DA4686EB81DB35E950179B3A6EF947C0F484231E91F5AA75EF3CE4818B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE126E45B8 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 68threadlibraryCOMMON
                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911159608.00007FFE126E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE126E0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911134066.00007FFE126E0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911210251.00007FFE126F0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911243230.00007FFE126F7000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911282295.00007FFE126FB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe126e0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_Eval_FromThread$Arg_AuditCharErrorFormatFreeLastLibraryLoadLong_Mem_ParseRestoreSaveStringSys_TupleUnicode_VoidWideWindows
                                                                                                                                                                                                    • String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
                                                                                                                                                                                                    • API String ID: 3805577924-808210370
                                                                                                                                                                                                    • Opcode ID: 8085d2a71d9d3a5a76fe34bec048b7c14a2e952a150ea8cd1b327b92dda5160e
                                                                                                                                                                                                    • Instruction ID: 301ed88db2af98624b420b206503b17980d8069f17358cdc1a800e34a9ec209e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8085d2a71d9d3a5a76fe34bec048b7c14a2e952a150ea8cd1b327b92dda5160e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 352119A5A0CE4382EF449B67ACA41B92761EF89BB5F1440B5C90E422F8DEACE4498354
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE126E2980 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 249COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911159608.00007FFE126E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE126E0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911134066.00007FFE126E0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911210251.00007FFE126F0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911243230.00007FFE126F7000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911282295.00007FFE126FB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe126e0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CallDeallocErr_FormatObject_memset
                                                                                                                                                                                                    • String ID: argument %zd: $too many arguments (%zi), maximum is %i
                                                                                                                                                                                                    • API String ID: 1791410686-4072972272
                                                                                                                                                                                                    • Opcode ID: beef4b385ab682cddc3e24ca64e313899eb60338a875c210d6dee6f8c8bec0f9
                                                                                                                                                                                                    • Instruction ID: 87896545717356c5a8bc4a58f9edd40f789b7b6e74a468f82ad6a2a9acd1be26
                                                                                                                                                                                                    • Opcode Fuzzy Hash: beef4b385ab682cddc3e24ca64e313899eb60338a875c210d6dee6f8c8bec0f9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 71B17C62A08E8289EB65CF27DC502B92361FF14BB8F144671DA6D477E9DFBCE5458300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4130 Relevance: 12.1, APIs: 8, Instructions: 69COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: List_$AppendDeallocFromLongLong_free
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 762243878-0
                                                                                                                                                                                                    • Opcode ID: d267d092ad2765b9a0c397b3d43bc25197c67c0a75636d4de6462b4b29143458
                                                                                                                                                                                                    • Instruction ID: b593904913e382331d26b65cbc013bc21cfa52f91286b5c97c754967e58a131b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d267d092ad2765b9a0c397b3d43bc25197c67c0a75636d4de6462b4b29143458
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2F214C36B09B4282EB959F25B92913977A4FFA8BC9B0C0435CE8D4A774EE3DE5418700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE10254EA8 Relevance: 10.6, APIs: 7, Instructions: 103COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1910216886.00007FFE10251000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10250000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910106258.00007FFE10250000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910283693.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910340707.00007FFE10260000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910368355.00007FFE10262000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe10250000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_Long_Occurred$Arg_KeywordsUnpack
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 591546834-0
                                                                                                                                                                                                    • Opcode ID: 20742500c124c423266bfdab1c304cd984d45cdb87b6458035995fc094c063de
                                                                                                                                                                                                    • Instruction ID: baddd62eec901a00f0b2ac5b74317be4b46f34f7206950a7763b7dd2adebac7d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 20742500c124c423266bfdab1c304cd984d45cdb87b6458035995fc094c063de
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A94187A5B09E4242FA649B2AA4547B9AAD0BF84BB8F140674DF1D43BE1FF7CE445C204
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C12C0 Relevance: 10.5, APIs: 7, Instructions: 37librarythreadloaderCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 568911590-0
                                                                                                                                                                                                    • Opcode ID: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
                                                                                                                                                                                                    • Instruction ID: c6675c027749859f0c59b5a7b4b7c307ce1d5b95f4137f1056e132bc9a4b4b71
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: FC014620B1CA4681EB989B22B90913EA265FF48FC6B488034DE4E4BB79DF3CE0458704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C77B0 Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: free$EnumErr_FromProcessesWindowsmalloc
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 4169093983-0
                                                                                                                                                                                                    • Opcode ID: c5f679809b8955f4bef8aecbc0fa992ed3e8a6855834a046f18260ff1a9ea1e4
                                                                                                                                                                                                    • Instruction ID: b8907cef9b7d0183c4aeb6b7f6431629a6622a4898c2f7d86ad0ca7b7f316b78
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c5f679809b8955f4bef8aecbc0fa992ed3e8a6855834a046f18260ff1a9ea1e4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 71113021A0974282EB948F15A85513A77A5FF88BC2F185035DF4E4BB74DE3CE445CB10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE10303AA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1910419727.00007FFE10301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE10300000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910393918.00007FFE10300000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910444327.00007FFE10307000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910474168.00007FFE1030C000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910499346.00007FFE1030E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe10300000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: D_do_all_providedDeallocFrozenModule_ObjectSet_
                                                                                                                                                                                                    • String ID: openssl_md_meth_names
                                                                                                                                                                                                    • API String ID: 4100423519-1600430994
                                                                                                                                                                                                    • Opcode ID: b9f0a5407aad8d662aa10f010dc060c6670fbd043fb592dcb7d36ce37e935762
                                                                                                                                                                                                    • Instruction ID: 58603f933e1a839c8180d18e71e51fcf8b26195c0ac1c76619a1c4721da28602
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b9f0a5407aad8d662aa10f010dc060c6670fbd043fb592dcb7d36ce37e935762
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CD014B75E0EE0282EA254B26E8052BE77A4BB48778F0445B5DB4E423B8DF7CE244C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE120C1000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1910922781.00007FFE120C1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE120C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910894077.00007FFE120C0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910951321.00007FFE120C2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910978175.00007FFE120C4000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe120c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Import$Capsule_DeallocImport_Module
                                                                                                                                                                                                    • String ID: charset_normalizer.md__mypyc$charset_normalizer.md__mypyc.init_charset_normalizer___md
                                                                                                                                                                                                    • API String ID: 1394619730-824592145
                                                                                                                                                                                                    • Opcode ID: 4dbea5a90385b545af12b2b3c19e32250d97452fe296dfd027e4427eacffc248
                                                                                                                                                                                                    • Instruction ID: fa3c724e036d3a190288ac99232d76b1f6471925bcd4d2cf07bd489d09d5d699
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4dbea5a90385b545af12b2b3c19e32250d97452fe296dfd027e4427eacffc248
                                                                                                                                                                                                    • Instruction Fuzzy Hash: AFE01AA5E0AE0289EA189B63AC441B022A26F64770FD946F5CA0D12774EEECA5658310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7C90 Relevance: 7.5, APIs: 5, Instructions: 36COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseHandle$ClearErr_ErrorLastOpenProcess
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2205208866-0
                                                                                                                                                                                                    • Opcode ID: 0945ff2416be1dab1ddef755a38572f861f52704ea47378d3cc6da18d26a0b1e
                                                                                                                                                                                                    • Instruction ID: 800c32d2aaf070cfe84996cedbdf51d49cdecf29096df14907b8da44b5d8a20e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0945ff2416be1dab1ddef755a38572f861f52704ea47378d3cc6da18d26a0b1e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1BF06830F1DE0743FBD95B16A4952392151EF587C2F044038D90F4E7B5ED2CE8858704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyArg_ParseTuple.PYTHON3 ref: 00007FFE014C751D
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C73F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE014C5C34), ref: 00007FFE014C7419
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C73F0: NtQuerySystemInformation.NTDLL ref: 00007FFE014C7442
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C73F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE014C5C34), ref: 00007FFE014C7459
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C73F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE014C5C34), ref: 00007FFE014C7463
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C73F0: PyErr_NoMemory.PYTHON3(?,?,?,00007FFE014C5C34), ref: 00007FFE014C7471
                                                                                                                                                                                                    • Py_BuildValue.PYTHON3 ref: 00007FFE014C7779
                                                                                                                                                                                                    • free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE014C778A
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: freemalloc$Arg_BuildErr_InformationMemoryParseQuerySystemTupleValue
                                                                                                                                                                                                    • String ID: kkdddkKKKKKKkKKKKKKKKK
                                                                                                                                                                                                    • API String ID: 1531563548-3509479964
                                                                                                                                                                                                    • Opcode ID: 1f48f599d5294805c0d50812fae6bd53fbe1b04007fa365ad7b5ed39c70fd0ae
                                                                                                                                                                                                    • Instruction ID: bbc0a979b634b657104bdb3720af9821cec61cf2af63fc9bd247607e29acdc52
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1f48f599d5294805c0d50812fae6bd53fbe1b04007fa365ad7b5ed39c70fd0ae
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CB616432615F858ADBA1CB29E49479DB3A9FB49790F018235EA8D57B24FF3DD045CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C1DC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49timeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BuildErr_FromSystemTimesValueWindows
                                                                                                                                                                                                    • String ID: (ddd)
                                                                                                                                                                                                    • API String ID: 2325294781-2401937087
                                                                                                                                                                                                    • Opcode ID: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
                                                                                                                                                                                                    • Instruction ID: 525845321496c1c4520c98fb6650f16cf54fa8656775f3cb35cb35e8dd7a27fa
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8E119631E29E414FC653D7359980526E3AAEFA9790B448322F50FB5E30EB2CE0978F00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE10254860 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1910216886.00007FFE10251000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10250000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910106258.00007FFE10250000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910283693.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910340707.00007FFE10260000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1910368355.00007FFE10262000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe10250000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Thread$RestoreSave_errnoclosesocket
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1624953543-0
                                                                                                                                                                                                    • Opcode ID: 4126259241acdad7b25acebef5f1c11f1c1da3f86697e3691b0e3be26900da62
                                                                                                                                                                                                    • Instruction ID: b75bffeea07dceb1a25d4f59589fef4cfea7dedc2c8c4cdb028fd164835a1846
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4126259241acdad7b25acebef5f1c11f1c1da3f86697e3691b0e3be26900da62
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4CF0FF61A18F8182EA145F56A8480A97761EB84BB4B144770DB7A037F5EFBCD486C204
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE148E4730 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911972744.00007FFE148E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911944001.00007FFE148E0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911998116.00007FFE148E6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1912024444.00007FFE148E9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe148e0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BufferConsoleInfoScreen
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3437242342-0
                                                                                                                                                                                                    • Opcode ID: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
                                                                                                                                                                                                    • Instruction ID: 78ea90a76b9f2e9161044804ee226d490219f8357c16d87d6016a8b7e211c75d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 29F01DB2508F45C9C702CF5AE45009DB724F756BD5F418A22EE8D63B29CF38C055CB50
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE148E42E0 Relevance: 1.4, APIs: 1, Instructions: 138COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911972744.00007FFE148E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911944001.00007FFE148E0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911998116.00007FFE148E6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1912024444.00007FFE148E9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe148e0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: memcpy
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3510742995-0
                                                                                                                                                                                                    • Opcode ID: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
                                                                                                                                                                                                    • Instruction ID: 8b0becd7bc32e01ef9077e9173146ae9a1d557fb18be035d7b3935749b4477a6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A5518F72B05F8585DB10CF2AD4845A8B364FB4AFB8B558272EE2C177A5DF38D859C340
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                                    Function 00007FFE0EB48318 Relevance: 107.0, APIs: 50, Strings: 11, Instructions: 276COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocDict_$FromItemLongLong_StringX_ctrl
                                                                                                                                                                                                    • String ID: accept$accept_good$accept_renegotiate$cache_full$connect$connect_good$connect_renegotiate$hits$misses$number$timeouts
                                                                                                                                                                                                    • API String ID: 3804526530-4076585280
                                                                                                                                                                                                    • Opcode ID: 6795432c43872d99297dd6691dbd99f19e11ee2d68f761c7603de0014746d8e1
                                                                                                                                                                                                    • Instruction ID: 131ce0a3983103c4310b16d59c33c17ee1b3fe25f786659cc1a73d76057123a5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6795432c43872d99297dd6691dbd99f19e11ee2d68f761c7603de0014746d8e1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 60C1EDAAA09B0782EA349F71E56467933A1FF45BC5B481434DECE0AB74EF6CE504CB41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB45750 Relevance: 94.9, APIs: 41, Strings: 13, Instructions: 356stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: String$Err_FromSizeUnicode_$E_printFormatL_sk_numL_sk_valueList_O_ctrlO_getsO_newO_s_memTuple_WarnX509_get_ext_d2istrchr
                                                                                                                                                                                                    • String ID: %X:%X:%X:%X:%X:%X:%X:%X$%d.%d.%d.%d$<INVALID>$<invalid>$DNS$DirName$IP Address$Invalid value %.200s$Registered ID$URI$Unknown general name type %d$email$failed to allocate BIO
                                                                                                                                                                                                    • API String ID: 359532264-4109427827
                                                                                                                                                                                                    • Opcode ID: 2a69ce4faf35dc1de16e22cfee398084fb9593ff6f16cc2b568dfdab1b28a2af
                                                                                                                                                                                                    • Instruction ID: 5415ceadf2eacb44470feff3127d3cf5662155a335e0610151c51a7e29d4d87f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a69ce4faf35dc1de16e22cfee398084fb9593ff6f16cc2b568dfdab1b28a2af
                                                                                                                                                                                                    • Instruction Fuzzy Hash: ACF17EB2A0EB8287EA758F25A85463967A1FF85B85F044531DACE467B4DF3CE504CF40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2E70 Relevance: 73.8, APIs: 38, Strings: 4, Instructions: 257threadstringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorEval_ModeThread$DeallocDriveRestoreSave$Arg_Err_FromList_LogicalObject_ParseStringsTrueTupleTypeWindowsmemsetstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$,compressed$,readonly$A:\
                                                                                                                                                                                                    • API String ID: 1159295088-2665560882
                                                                                                                                                                                                    • Opcode ID: 899e8b6210c06aa593ec25680636306fff9e7cbffd21001d0271cfc90c15a533
                                                                                                                                                                                                    • Instruction ID: 9b0c2e4ead5054e3caa8abb87573372aefc9e225c3df3cccc8b1c7a164133774
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 899e8b6210c06aa593ec25680636306fff9e7cbffd21001d0271cfc90c15a533
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 25C18031A0CB8686EBA0DF21E8542B9A3A5FF85B99F408135D94E4B7B4DF3CE509C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2B00 Relevance: 59.7, APIs: 26, Strings: 8, Instructions: 184fileCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_func$fprintf$DeallocErrorLast$CloseControlDeviceDict_Handleswprintf_s$BuildCreateErr_FileFromItemStringValueWindows__stdio_common_vsprintf_s
                                                                                                                                                                                                    • String ID: $(IILLKK)$DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i$DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i$PhysicalDrive%i$\\.\PhysicalDrive%d$psutil-debug [%s:%d]> $psutil/arch/windows\disk.c
                                                                                                                                                                                                    • API String ID: 3661822457-4277503146
                                                                                                                                                                                                    • Opcode ID: 124d38539af5ce6e410e20cc0c76a4fa7ca0080656d27914580480a91f11bf1e
                                                                                                                                                                                                    • Instruction ID: 3ee11bf5461f6dbf68b908f8d8a136d82a08e6e626f30e58b9bfb98dd7ea9ad5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 124d38539af5ce6e410e20cc0c76a4fa7ca0080656d27914580480a91f11bf1e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D1916535A08B8282E7A0DB51F8956BA73A4FB84B94F400136DE8E4BB75DF7CE545CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2480 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 247nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: free$Err_$InformationMemoryQuerySystem__acrt_iob_funcfprintfmalloc$BuildFromStringValueWindows
                                                                                                                                                                                                    • String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemInterruptInformation)$NtQuerySystemInformation(SystemPerformanceInformation)$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$kkkk$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
                                                                                                                                                                                                    • API String ID: 1058843278-3097090287
                                                                                                                                                                                                    • Opcode ID: a8bfd232d7eec5b1b700ffb92ecce9312499a9b34e800496a63b67fd30f91bab
                                                                                                                                                                                                    • Instruction ID: 52fb71a626edde3c06b6fb7ac722f06ee4429ce8e41e599cc1a914b133dde8b4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a8bfd232d7eec5b1b700ffb92ecce9312499a9b34e800496a63b67fd30f91bab
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BAB1E171E18A428BEB91DF25E4545B963A4FFA4B89B404236DA0E5B770EFBDF509C300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C6AA0 Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 229nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseHandle$ErrorProcess$Err_LastMemory$Read$FilenameFromQueryWindowsWith$CallDeallocFunctionInformationObjectObject_OpenStatusVirtualcallocfree
                                                                                                                                                                                                    • String ID: (originated from %s)$NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessWow64Information)$OpenProcess$VirtualQueryEx$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 1900539510-2577306957
                                                                                                                                                                                                    • Opcode ID: 0ef9ee712c53338aacc33a4b58fad6bd73f10f269aeb428fa9326c9581995db0
                                                                                                                                                                                                    • Instruction ID: 11e38d5845e6ffc4d829ffd4b31596767471865e83947d966c5bd31284ba8a3d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0ef9ee712c53338aacc33a4b58fad6bd73f10f269aeb428fa9326c9581995db0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 81A17F21B08A4282EBA49B22E8546BD2365FF44B98F418135DE4E4FBB4EF3CE546D341
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C6600 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 200memorynativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$Process$Free$DeallocErr_Handle$AllocCloseCriticalFromInformationList_QuerySectionSystem$AppendCharCreateCurrentDuplicateEnterErrorFilenameLastLeaveMemoryStringThreadUnicode_WideWindowsWith
                                                                                                                                                                                                    • String ID: NtQuerySystemInformation$SystemExtendedHandleInformation buffer too big
                                                                                                                                                                                                    • API String ID: 3865821507-122811375
                                                                                                                                                                                                    • Opcode ID: e7310a011497c24ccc7213657edd25fa229afd217a41b923e3b4ff18826ba04b
                                                                                                                                                                                                    • Instruction ID: e5895e65c5f6608fa9f93c831c1f5c9c2b3019bb848ce5558b6bc44ddf2be464
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e7310a011497c24ccc7213657edd25fa229afd217a41b923e3b4ff18826ba04b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BF917A71A09A4685FBA49B62E80837A23A5FF89BD5F058035CD5E4B3B4EF3DE449C310
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4B6C8 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 206threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • _PyObject_GC_New.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B766
                                                                                                                                                                                                    • ERR_clear_error.LIBCRYPTO-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B7A9
                                                                                                                                                                                                    • PyEval_SaveThread.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B7AF
                                                                                                                                                                                                    • SSL_new.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B7BB
                                                                                                                                                                                                    • PyEval_RestoreThread.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B7C8
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B7E0
                                                                                                                                                                                                    • SSL_get0_param.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B7FC
                                                                                                                                                                                                    • X509_VERIFY_PARAM_set_hostflags.LIBCRYPTO-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B808
                                                                                                                                                                                                    • SSL_set_ex_data.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B817
                                                                                                                                                                                                    • SSL_set_fd.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B82A
                                                                                                                                                                                                    • BIO_up_ref.LIBCRYPTO-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B83E
                                                                                                                                                                                                    • BIO_up_ref.LIBCRYPTO-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B850
                                                                                                                                                                                                    • SSL_set_bio.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B862
                                                                                                                                                                                                    • SSL_ctrl.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B877
                                                                                                                                                                                                    • SSL_get_verify_mode.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B890
                                                                                                                                                                                                    • SSL_get_verify_callback.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B8A1
                                                                                                                                                                                                    • SSL_set_verify.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B8B3
                                                                                                                                                                                                    • SSL_set_post_handshake_auth.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B8BD
                                                                                                                                                                                                    • SSL_get_rbio.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B8EB
                                                                                                                                                                                                    • BIO_ctrl.LIBCRYPTO-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B900
                                                                                                                                                                                                    • SSL_get_wbio.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B90A
                                                                                                                                                                                                    • BIO_ctrl.LIBCRYPTO-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B91B
                                                                                                                                                                                                    • PyEval_SaveThread.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B921
                                                                                                                                                                                                    • SSL_set_connect_state.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B933
                                                                                                                                                                                                    • SSL_set_accept_state.LIBSSL-3(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B93B
                                                                                                                                                                                                    • PyEval_RestoreThread.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B944
                                                                                                                                                                                                    • PyWeakref_NewRef.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B958
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B99C
                                                                                                                                                                                                    • PyObject_GC_Track.PYTHON311(?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB4B9D3
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    • Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FFE0EB4B755
                                                                                                                                                                                                    • Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FFE0EB4B70E
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Thread$DeallocO_ctrlO_up_refObject_RestoreSave$L_ctrlL_get0_paramL_get_rbioL_get_verify_callbackL_get_verify_modeL_get_wbioL_newL_set_accept_stateL_set_bioL_set_connect_stateL_set_ex_dataL_set_fdL_set_post_handshake_authL_set_verifyM_set_hostflagsR_clear_errorTrackWeakref_X509_
                                                                                                                                                                                                    • String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context
                                                                                                                                                                                                    • API String ID: 4263894999-1683031804
                                                                                                                                                                                                    • Opcode ID: 321b71f3c7c72c6944827377fb721ab8bbab2dcf9724bb77fa148d918ae46493
                                                                                                                                                                                                    • Instruction ID: 7b1c6be51b0dc4517ebf068f4c88ac53375070a883cff7fb6af487f3c4b46dd6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 321b71f3c7c72c6944827377fb721ab8bbab2dcf9724bb77fa148d918ae46493
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9E912CB6A08B5282EB748F26E88463963A1FF89B94F145535CF8E47B70DF3CE5458B01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3990 Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 261COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$BuildFromList_StringUnicode_Valueinet_ntop$Appendfree$AdaptersAddressesCharConvertErr_Ipv4LengthMaskWideswprintf_s
                                                                                                                                                                                                    • String ID: %.2X$%.2X-$(OiOOOO)
                                                                                                                                                                                                    • API String ID: 2354107120-528653562
                                                                                                                                                                                                    • Opcode ID: f106ddbcbd649314331a3d663db6b5b52ba08807c3d0a313a8d4435bfb40f95d
                                                                                                                                                                                                    • Instruction ID: 9d05d7d7aff0659a381502977bd4196367f577bc40769bc223ca05c3c1255d27
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f106ddbcbd649314331a3d663db6b5b52ba08807c3d0a313a8d4435bfb40f95d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8AC14B32A09B8681EBA49F22E84467A73A4FF99BD9F048135CA4E4B774DF3DE445C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4A70 Relevance: 50.9, APIs: 23, Strings: 6, Instructions: 166memorynativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$Process$CloseErr_HandleMemory$AllocFreeQueryVirtual$Arg_CallDeallocErrorFunctionLastObjectObject_OpenParseStringTuple
                                                                                                                                                                                                    • String ID: NtQueryVirtualMemory -> STATUS_ACCESS_DENIED$NtQueryVirtualMemory bufsize is too large$NtQueryVirtualMemory(MemoryWorkingSetInformation)$OpenProcess$automatically set for PID 0$psutil_pid_is_running -> 0
                                                                                                                                                                                                    • API String ID: 757443668-943580704
                                                                                                                                                                                                    • Opcode ID: b268c0a205ee89698f7ecb034eea43e26effefc4437ad2565521dba9cbae3057
                                                                                                                                                                                                    • Instruction ID: fe434b4d23ef2da782ffd54e7011ba615cb92f00d34e94431f5f85c64ba4b688
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b268c0a205ee89698f7ecb034eea43e26effefc4437ad2565521dba9cbae3057
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D5616B71F08A4786FB909B26E96827963A1FF89BD5F498531CD4E4B7B4EE3CE4458300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8170 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 181serviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$From$CharCloseEnumErrorHandleLastList_ServiceServicesStatusUnicode_Widefree$AppendBuildErr_FilenameManagerOpenValueWindowsWith__stdio_common_vsprintfmalloc
                                                                                                                                                                                                    • String ID: (OO)$(originated from %s)$OpenSCManager
                                                                                                                                                                                                    • API String ID: 1483861492-3715750162
                                                                                                                                                                                                    • Opcode ID: 195cc5c3da62f8f462114c908a92565c25d776aa1aa7a1f07918c9f707783332
                                                                                                                                                                                                    • Instruction ID: ceb7f1b58466e8e39ef28ea1ef5a9720d9c1dce814ceab20409d77f3c648a05c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 195cc5c3da62f8f462114c908a92565c25d776aa1aa7a1f07918c9f707783332
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 77816D75A09B4381EBA48F21E84427AB3A4FF85BE5F444135CA9E4A7B4EF3CE449C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C6E40 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 130nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseHandle$Err_Process$InformationMemoryQuerycallocfree$ErrorLastOpenStringwcscpy_s
                                                                                                                                                                                                    • String ID: NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND$NtQueryInformationProcess(ProcessCommandLineInformation)$OpenProcess$automatically set for PID 0$requires Windows 8.1+
                                                                                                                                                                                                    • API String ID: 3434980512-710783819
                                                                                                                                                                                                    • Opcode ID: 78b1fb1da60bea354a6ff4f4627294ac2768f77e768ca7fe235a9d5badf2eb20
                                                                                                                                                                                                    • Instruction ID: af1002681a06904b1371027248e016a004a8eaac51d1c7c90e8ba5f9808454d0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 78b1fb1da60bea354a6ff4f4627294ac2768f77e768ca7fe235a9d5badf2eb20
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B8516931A0CA0386FB949B26E86427963A1EF89BE0F558135DD5E4B7B4EF3CE446C701
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4DF0 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 163threadtimeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseDeallocHandle$List_ThreadThread32$AppendArg_BuildCallErr_FirstFunctionNextObjectObject_OpenParseTimesTupleValue
                                                                                                                                                                                                    • String ID: CreateToolhelp32Snapshot$GetThreadTimes$Thread32First$forced for PID 0$kdd$psutil_pid_is_running -> 0
                                                                                                                                                                                                    • API String ID: 3176497124-1899450870
                                                                                                                                                                                                    • Opcode ID: 4b1803a0e1a9fd31ec149b553d533706af3d0e24f77cd05c6afc974b9b65d425
                                                                                                                                                                                                    • Instruction ID: ff24869d8bacda6072ca857128a61b7a71150c409f46bbdf5704a1b7ca562781
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4b1803a0e1a9fd31ec149b553d533706af3d0e24f77cd05c6afc974b9b65d425
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0971B331A0CA4286EB91DB25E55027AB3A5FF95BD4F494231E94E4BBB4EF3CE445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49AB4 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 177threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Deadline_DeallocErr_Eval_O_ctrlThread$CheckFromInitL_get_rbioL_get_wbioL_write_exLong_ObjectR_clear_errorR_peek_last_errorRestoreSaveSignalsSize_tStringWeakref_
                                                                                                                                                                                                    • String ID: 3$The write operation timed out$Underlying socket connection gone$Underlying socket has been closed.$Underlying socket too large for select().
                                                                                                                                                                                                    • API String ID: 919700936-2917282068
                                                                                                                                                                                                    • Opcode ID: 0094ce06a64726d999ed363e026e3c244ba7ab337a813fc3f9d5ae26417737cc
                                                                                                                                                                                                    • Instruction ID: 68171c6376e17b6ee0c4fea1f80670cab575da82a77b5fa9ef8b944ad0d8da10
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0094ce06a64726d999ed363e026e3c244ba7ab337a813fc3f9d5ae26417737cc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A6717EA6A08B4786EB759F22985067A27A0FFC9B94F104031DE8E43774DF3CE486CB41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A0F4 Relevance: 34.7, APIs: 23, Instructions: 173encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Cert$From$StoreString$ErrorInternLastSet_Unicode_$Bytes_CertificateCertificatesCloseContextEnhancedEnumErr_FreeListOpenSequence_SizeTuple_UsageWindows
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2957225168-0
                                                                                                                                                                                                    • Opcode ID: 54cdaaec30bf76d102674aae65a525d9026e867f396c37bdceefa3c111e5ce6f
                                                                                                                                                                                                    • Instruction ID: ac66b83503c32a2bfed314e91240b27e6fed08b307fc4f9e7197832902ee9f08
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 54cdaaec30bf76d102674aae65a525d9026e867f396c37bdceefa3c111e5ce6f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C461F6F1E4DB5282FA799F71995813963A4EF55F90F084834CACE06BA0EE3DE8459B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB496BC Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 179threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Deadline_DeallocEval_O_ctrlThread$Err_InitL_get_rbioL_get_wbioL_set_read_aheadL_shutdownObjectRestoreSaveStringWeakref_
                                                                                                                                                                                                    • String ID: B$The read operation timed out$The write operation timed out$Underlying socket connection gone$Underlying socket too large for select().
                                                                                                                                                                                                    • API String ID: 1084328889-1139084988
                                                                                                                                                                                                    • Opcode ID: 936754176adb88edd73df524168192cbb0d099f55e8b6c5147d59a82ba7fc610
                                                                                                                                                                                                    • Instruction ID: 10c3c690d0faae27f536be9b3dece67eda5a3a42e1044f9c6368e0470735ce07
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 936754176adb88edd73df524168192cbb0d099f55e8b6c5147d59a82ba7fc610
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B5713AB2A08B4786EB758F26A84427A63A1FFC9B94F144135CECE466B4DF3CE5458B01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C99D0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 253COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$BuildCharErrorFromLastList_Unicode_ValueWideswprintf_s
                                                                                                                                                                                                    • String ID: %u.%u.%u.%u$OOd$WTSEnumerateSessionsW$WTSQuerySessionInformationW
                                                                                                                                                                                                    • API String ID: 35727893-281470548
                                                                                                                                                                                                    • Opcode ID: 8371fea4dd9a31fa5fb0cdb5e122f058097f0c7848355597719a5dec61cc45ad
                                                                                                                                                                                                    • Instruction ID: 8322cbb8f61fc9fc12242302e34a9b969e46e96806f6bcb3e55e669cbc07a691
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8371fea4dd9a31fa5fb0cdb5e122f058097f0c7848355597719a5dec61cc45ad
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B1C13836B09A4295EBA48F61E8542BD33A5EF44B88F044539DD4E6BAB8DF3CE446C300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB489D4 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 162threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Deadline_DeallocErr_Eval_O_ctrlThread$CheckInitL_do_handshakeL_get_rbioL_get_wbioObjectR_clear_errorR_peek_last_errorRestoreSaveSignalsStringWeakref_
                                                                                                                                                                                                    • String ID: Underlying socket connection gone$_ssl.c:989: The handshake operation timed out$_ssl.c:993: Underlying socket has been closed.$_ssl.c:997: Underlying socket too large for select().
                                                                                                                                                                                                    • API String ID: 3614085790-581767418
                                                                                                                                                                                                    • Opcode ID: 17737c3524be212198b1c7c822f6750bb7c5f8157cb6937e239e7570bae276df
                                                                                                                                                                                                    • Instruction ID: 74db41afcfa2ea46c9f6ffeada0fba423cef5ce915b5a9e4c0ba378587f9de32
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 17737c3524be212198b1c7c822f6750bb7c5f8157cb6937e239e7570bae276df
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 956171B6A09B4289EB799F22985057923A0FF89B98F144131EE8E47775DF3DE481CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A440 Relevance: 30.1, APIs: 20, Instructions: 138encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CertFrom$StoreString$InternSet_Unicode_$Bytes_CloseContextEnumErr_ErrorFreeLastListOpenSequence_SizeTuple_Windows
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1063190953-0
                                                                                                                                                                                                    • Opcode ID: d88d69fa8b7b71d58f8261edff1aabfe64e22e51b3afd6756da802cac005f422
                                                                                                                                                                                                    • Instruction ID: 2409705608e0f99db604840f43dd956cea8d2ef2e9e58ae47d256b3f3c882d36
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d88d69fa8b7b71d58f8261edff1aabfe64e22e51b3afd6756da802cac005f422
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 78511CB1E8DB1285FA799F71AA5813972A4EF54B90F084434CACE06BB4EE3CE4458B01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0AAC80 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 105threadencryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_String$Arg_Eval_ParseThreadTupleU_object@@$Bytes_CryptError@@FindInfoKeywordsLongLong_Object_OccurredRestoreSaveWin_
                                                                                                                                                                                                    • String ID: CryptFindOIDInfo$Key must be a tuple of 2 ints when KeyType is CRYPT_OID_INFO_SIGN_KEY$Unrecognized key type$kO|k
                                                                                                                                                                                                    • API String ID: 167753082-3539979041
                                                                                                                                                                                                    • Opcode ID: 4ac0c776bfce34d46c55ff558e4fd961344c98023f07967c6bb72fbcfcfd0e98
                                                                                                                                                                                                    • Instruction ID: ec48864e41d25fe9cfd9424c19500a47d8da71e4d9aa5d66daf3c53ed8ce7443
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4ac0c776bfce34d46c55ff558e4fd961344c98023f07967c6bb72fbcfcfd0e98
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CB412D35B88A4281EF10CF69E86416D63A2FF84B95F941035DA8E83BB4DF3DE449CB04
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A4880 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 120encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BufferCryptEncryptErr_Error@@StringU_object@@View@@Win_$Arg_Bytes_FromKeywordsMemoryParseSizeTupleU_object@@_freemalloc
                                                                                                                                                                                                    • String ID: CryptEncrypt$Object must be of type PyCRYPTHASH$lO|Ok:CryptEncrypt
                                                                                                                                                                                                    • API String ID: 3967936622-1354874914
                                                                                                                                                                                                    • Opcode ID: 854fd57fe716cf2d13cd7abff4e5fec7fc8d73fc4a7012ce57dd9f181feafd57
                                                                                                                                                                                                    • Instruction ID: fb58d6a16d1542a0e4646b07d9fa38def90e821694d4a2e9c4b993625f5d7234
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 854fd57fe716cf2d13cd7abff4e5fec7fc8d73fc4a7012ce57dd9f181feafd57
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DB512C36B49A428AE710CF69E4606AD73A6FF48B88F405135DE4E53B78DF38E545C708
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A4050 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 98encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CryptError@@HashKeywordsParamParseTupleU_object@@Win_
                                                                                                                                                                                                    • String ID: Hash parameter %d is not yet supported$PyCRYPTHASH::CryptGetHashParam$Unable to allocate %d bytes$k|k:CryptGetHashParam
                                                                                                                                                                                                    • API String ID: 4230166517-3481413517
                                                                                                                                                                                                    • Opcode ID: d0c78ebc272004516930a7ac71e361bfe457a31bc7ec92ddcd7bd6e59b53b5b0
                                                                                                                                                                                                    • Instruction ID: 26b069feda5ee0973083b40c8aa8dd64f357cfc5d67b497fad9fa44dbbb1a588
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d0c78ebc272004516930a7ac71e361bfe457a31bc7ec92ddcd7bd6e59b53b5b0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DE414C75A5864282EB40CF5AF86046AB3A2FF84BD4F545032DA4E43B78DF7CE445CB08
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C601F Relevance: 25.7, APIs: 17, Instructions: 178processCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$From$CloseDict_HandleLongLong_Process32$CreateErr_FirstItemNextSnapshotToolhelp32Windowsmemset
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1629090121-0
                                                                                                                                                                                                    • Opcode ID: 7be852412763a4fa0347f2dfa8f5090d1cb8f8ef5aa0830bdb390199af98f7b8
                                                                                                                                                                                                    • Instruction ID: 034d5b590ab8480e8bf6115006fe7efb5cafa5750cbda0028c8c01ef3fb6dd69
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7be852412763a4fa0347f2dfa8f5090d1cb8f8ef5aa0830bdb390199af98f7b8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2351B732A0D78286E7A69F35E85427D37A5EF85BA5F098031CA8E0F7B6DE2CD445C701
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A4440 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 108encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CryptErr_Error@@ExportStringU_object@@Win_$Arg_Bytes_FormatFromKeywordsParseSizeTuplefreemalloc
                                                                                                                                                                                                    • String ID: CryptExportKey$Object must be of type PyCRYPTKEY$Ok|k:CryptExportKey$PyCRYPTKEY::CryptExportKey: Unable to allocate %d bytes
                                                                                                                                                                                                    • API String ID: 1765650860-2655833073
                                                                                                                                                                                                    • Opcode ID: c57962fb4aa4c87388720af4d3e30e422467e75636b8d33ad984388e77ac2610
                                                                                                                                                                                                    • Instruction ID: be17082ba148d7a8270d7fa1afcb58eb3dfae62619cd1e70a929f4853ccc9301
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c57962fb4aa4c87388720af4d3e30e422467e75636b8d33ad984388e77ac2610
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F9414A36B49A0286EB10CF59E86447973A6FF88B90B581135DB4E43774DF3CE886CB08
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C6250 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82memorynativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$Process$AllocFree$Err_ErrorFileLastMemoryObjectQueryType
                                                                                                                                                                                                    • String ID: NtQuerySystemInformation
                                                                                                                                                                                                    • API String ID: 448133315-2549949336
                                                                                                                                                                                                    • Opcode ID: c7644b72ed90970b7715efcc7706220d12c8163474f1af4865f9a794fa3504a9
                                                                                                                                                                                                    • Instruction ID: 897935c003875259c60e77b1b013be4a844ae55b74357214c3233d5e662d3155
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c7644b72ed90970b7715efcc7706220d12c8163474f1af4865f9a794fa3504a9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 88315B35A0CB0286FB949B65F84823D67A1FF89B90F158439DA8E4B7B1DF3DE8448700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A5890 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 84COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_Err_FormatKeywords_ParseSizeTuplemalloc
                                                                                                                                                                                                    • String ID: CryptGenRandom: Unable to allocate %zd bytes$PyCRYPTPROV::CryptGenRandom$k|z#
                                                                                                                                                                                                    • API String ID: 1718167496-62374806
                                                                                                                                                                                                    • Opcode ID: f1ef6c83ff69561fdda2f94dfe968d2028b42aa998afe3ceeffd7657a54e8301
                                                                                                                                                                                                    • Instruction ID: 064f085a763fa5384c0a9fd84301f8bb082c4b840b6fdd15aacd4e6d2cbc5cec
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f1ef6c83ff69561fdda2f94dfe968d2028b42aa998afe3ceeffd7657a54e8301
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 34313E32B48A4682EA04CB2AE8640AD73A6FF88BD4B584135DF4E47764DF3CD446CB04
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A5C70 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 81encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CryptError@@ExportInfoKeywords_ParsePublicSizeTupleU_object@@Win_
                                                                                                                                                                                                    • String ID: CryptExportPublicKeyInfo$CryptExportPublicKeyInfo: Unable to allocate %d bytes$k|k:CryptExportPublicKeyInfo
                                                                                                                                                                                                    • API String ID: 4146695621-84361842
                                                                                                                                                                                                    • Opcode ID: a46ff1bf334687dffd8b452e5c82d80f37b7ea88bbefe5753632c3487b69eca2
                                                                                                                                                                                                    • Instruction ID: 85b6d7fe14c287aab499898a78b981387e4a74865d6a2125ce93364721eebb8a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a46ff1bf334687dffd8b452e5c82d80f37b7ea88bbefe5753632c3487b69eca2
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A6311D31A58B4282EB10CF5AF86446AB7A6FF84BD4F540031EA4E43B68DF7CE545CB08
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44EA8 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 66COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB41558: OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFE0EB4159D
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB41558: PyUnicode_FromStringAndSize.PYTHON311 ref: 00007FFE0EB415C3
                                                                                                                                                                                                    • ASN1_STRING_type.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB44DA7), ref: 00007FFE0EB44EEC
                                                                                                                                                                                                    • ASN1_STRING_length.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB44DA7), ref: 00007FFE0EB44EFA
                                                                                                                                                                                                    • ASN1_STRING_get0_data.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB44DA7), ref: 00007FFE0EB44F06
                                                                                                                                                                                                    • _Py_BuildValue_SizeT.PYTHON311(?,?,?,?,00000000,00007FFE0EB44DA7), ref: 00007FFE0EB44F1C
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB461AC: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE0EB461C4
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB461AC: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE0EB461F0
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Size$BuildFromG_get0_dataG_lengthG_typeJ_obj2txtR_clear_errorR_peek_last_errorStringUnicode_Value_
                                                                                                                                                                                                    • String ID: D:\a\1\s\Modules\_ssl.c$Ns#$Ny#
                                                                                                                                                                                                    • API String ID: 264388756-3706530764
                                                                                                                                                                                                    • Opcode ID: 32bac669afca5feb3bfbb68860ac505a1dc5f1463d8d5d14d6ffe83814a3c2f9
                                                                                                                                                                                                    • Instruction ID: 4e6db6d38883c9a3cb55898435fee24ee43ea6e32c85f055e673c35e2e485705
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 32bac669afca5feb3bfbb68860ac505a1dc5f1463d8d5d14d6ffe83814a3c2f9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BA216DA5B0C79282FA208F26A554379A360EF8ABD5F544530DECE46B75DF3CE1568F00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4D00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 66nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Process$Object_$Arg_CallCloseDeallocErr_ErrorFunctionHandleLastObjectOpenParseResumeSuspendTrueTuple
                                                                                                                                                                                                    • String ID: NtSuspend|ResumeProcess$OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 3554915889-3759402225
                                                                                                                                                                                                    • Opcode ID: a618a4232d13e5af49887075117a5db5f1406d7c7aa31298e858ec2d764e8207
                                                                                                                                                                                                    • Instruction ID: bb0a1840e23b3b3ef03c209a89f8a88bfe0076d24b4d5fdb54f0aa7f93285a90
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a618a4232d13e5af49887075117a5db5f1406d7c7aa31298e858ec2d764e8207
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3F216021B0CA0682FBD5EB26E9911B963A1EF88BC5F584035DA4E4B7B5DE2CE845C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5720 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 63nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Process$Arg_BuildCallCloseDeallocErr_ErrorFunctionHandleInformationLastObjectObject_OpenParseQueryTupleValue
                                                                                                                                                                                                    • String ID: NtQueryInformationProcess$OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 2930197940-1336995763
                                                                                                                                                                                                    • Opcode ID: d04e1c3e4a5a9d9669090c4c38d6b7fc0999f164d90e7b711581c994212fc07e
                                                                                                                                                                                                    • Instruction ID: 9652101e3291dcbeabed1d801ea0b91f5cce039cfdcd58e4e9c739467bb8c9ab
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d04e1c3e4a5a9d9669090c4c38d6b7fc0999f164d90e7b711581c994212fc07e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CA215E61B0DA42C2FB80DB15E8812BDA3A1EF84BD4F984535DA4D4F7B5EE2CF8858740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2A30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_FreeThread$Arg_BuildCharDiskErr_FilenameFromMem_ObjectParseRestoreSaveSpaceStringTupleUnicode_ValueWideWindowsWith
                                                                                                                                                                                                    • String ID: (LL)
                                                                                                                                                                                                    • API String ID: 4101313974-591180812
                                                                                                                                                                                                    • Opcode ID: b068e9dae5a6de77f38790b3924a703566198fee7ed684031e271233b0b90aa3
                                                                                                                                                                                                    • Instruction ID: 4c8883b0411856757f4f076b46de2e5c41ba88ccd2f6168f88d0770b7e24cc52
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b068e9dae5a6de77f38790b3924a703566198fee7ed684031e271233b0b90aa3
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 00112125A0CA96C2EB509B66F8450B9A375FF88BD9F484032DE4D4B734DEBCD54AC740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5810 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63nativeCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Process$Arg_CallCloseDeallocErr_ErrorFunctionHandleInformationLastObjectObject_OpenParseTuple
                                                                                                                                                                                                    • String ID: NtSetInformationProcess$OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 2437414965-2953277767
                                                                                                                                                                                                    • Opcode ID: 9994b81de630f7c23aca50d230ec21d65d240a75d59b1f11fa76792722c9ecf2
                                                                                                                                                                                                    • Instruction ID: 2b9afe23d54edf34d94fd2a471a4c09712f6390ef9a96542ad9a4f48b04fce2b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9994b81de630f7c23aca50d230ec21d65d240a75d59b1f11fa76792722c9ecf2
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F0215E21B1CA4282FB85DB16E8812BE63A1EF88BC1F485035DA1D4F7B5EE3CE4958710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0AA040 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50threadencryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Object_$Eval_ThreadU_object@@$Arg_CryptFindFreeFromKeywordsLocalizedNameParseRestoreSaveTuple
                                                                                                                                                                                                    • String ID: O:CryptFindLocalizedName
                                                                                                                                                                                                    • API String ID: 2786140858-1113378710
                                                                                                                                                                                                    • Opcode ID: 4b3e615602d8484f7a8c4103ac7480439bc4b772cfae728c8e703da30a22d1d4
                                                                                                                                                                                                    • Instruction ID: 8451fdc239ce1dbaba9d83cea96b390ae675a854f6c67d2c142273534f2e93df
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4b3e615602d8484f7a8c4103ac7480439bc4b772cfae728c8e703da30a22d1d4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9A11F935B88B4281DB14DB5AF96456AB3A2FF88BD4F541036DA4E43B64DF3CE045CB04
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE13241B00 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 313767242-0
                                                                                                                                                                                                    • Opcode ID: 491c6c3a996b181e7d4f6ff731a66c8976c72585f48119a1a83f76a26148e78e
                                                                                                                                                                                                    • Instruction ID: 1f15362d168e633d1fc5f03019653a485b12c45cafd3a3ed881ca080ab7aa98f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 491c6c3a996b181e7d4f6ff731a66c8976c72585f48119a1a83f76a26148e78e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D6316D72708E81CAEB60AF61E8403ED3360FB94754F44453ADB8E57AA8EF38D658C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CFA1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1906351414.00007FFE0CFA1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FFE0CFA0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906304405.00007FFE0CFA0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906396362.00007FFE0CFA6000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906458473.00007FFE0CFAB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cfa0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 313767242-0
                                                                                                                                                                                                    • Opcode ID: b1f9e4b8cb76c58f9ad273c7ab6db637e490d5b196a1216b4705d07cf26add3e
                                                                                                                                                                                                    • Instruction ID: 7f6c071d35b435d82e6b9ea753098b716ee84082c5e3115224f880ea8e34e911
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b1f9e4b8cb76c58f9ad273c7ab6db637e490d5b196a1216b4705d07cf26add3e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: FD3153B2644B81C5EB608F65E8507EDB3A4FF44744F48903ADA4E47BA4DF38D548C715
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB42FF8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 313767242-0
                                                                                                                                                                                                    • Opcode ID: 95a6715441451f332765c81f1ec3e8738af08fa5e0456622ef6d16990be337b9
                                                                                                                                                                                                    • Instruction ID: 3999ed4e5a698ba63816adc6bf27c22f461603cb06464219f4ab680fddd3c2ea
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 95a6715441451f332765c81f1ec3e8738af08fa5e0456622ef6d16990be337b9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F314FB2609B8286EB709F64E8503ED73A5FB84744F44443ADA8E47BA9DF3CD549CB10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014CA978 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 313767242-0
                                                                                                                                                                                                    • Opcode ID: 79acbbb7203818977d8a754fe1bae67d43b59f87135d3928d7a62293b6b12fe9
                                                                                                                                                                                                    • Instruction ID: bb079584d41840c417ac77865c0a071a566eef847da01a4c7225e7c0ea9016ff
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 79acbbb7203818977d8a754fe1bae67d43b59f87135d3928d7a62293b6b12fe9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 97317072609B858AEBA09F60E8413EE7365FB84745F44443ADA4E4BBB4EF3CD548C710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB21960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908816347.00007FFE0EB21000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFE0EB20000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908712620.00007FFE0EB20000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908843001.00007FFE0EB24000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908867951.00007FFE0EB25000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908898664.00007FFE0EB26000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb20000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 313767242-0
                                                                                                                                                                                                    • Opcode ID: 8cd5be0b42e6e7f0319df2977d08f00477f2cc742b936249396d47c5008990bc
                                                                                                                                                                                                    • Instruction ID: fe9041e4f4efabf8ead2e4ff514729b5df14a74839ad41af4de4a371c0a1b806
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8cd5be0b42e6e7f0319df2977d08f00477f2cc742b936249396d47c5008990bc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F2315272609B8289EB708F64E8507EE7360FB94744F44443ADA8E47BA4DF3CDA48CB14
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB22160 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 125COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908816347.00007FFE0EB21000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFE0EB20000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908712620.00007FFE0EB20000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908843001.00007FFE0EB24000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908867951.00007FFE0EB25000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908898664.00007FFE0EB26000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb20000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: memset$_wassert
                                                                                                                                                                                                    • String ID: hs->curlen < BLOCK_SIZE$src/SHA1.c
                                                                                                                                                                                                    • API String ID: 3746435480-330188172
                                                                                                                                                                                                    • Opcode ID: 603f01a09e6466173747a0b7a0d06d3a4aa1c2544d88be7af2bd99f1857fc59a
                                                                                                                                                                                                    • Instruction ID: 67c7160640dca594770061202a0c14bcfcc8d128bb8a23fce94a18b61477b434
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 603f01a09e6466173747a0b7a0d06d3a4aa1c2544d88be7af2bd99f1857fc59a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1451AF136192D08EC30ACF7D851006D7FB1E726B4870CC0BADBE58B75BCA18DA69CB61
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8AA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40serviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Service$Arg_CloseHandleParseStartTuple
                                                                                                                                                                                                    • String ID: StartService
                                                                                                                                                                                                    • API String ID: 2343249381-99420325
                                                                                                                                                                                                    • Opcode ID: d11108fcf47cce4952642d244d575706abaf3b0d0eade9631ebbf9717496257b
                                                                                                                                                                                                    • Instruction ID: 59a1e4fabc93f10ac7e344b50974e55927d6bcd875e5f7d6a13f86ddca50f95a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d11108fcf47cce4952642d244d575706abaf3b0d0eade9631ebbf9717496257b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 74011E64F09A4781EB94DB27EC9127663A0FF89BC5F880031DA4D4B775EE3DD5458700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44C24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Bytes_FromO_freeR_clear_errorR_peek_last_errorSizeStringX509i2d_
                                                                                                                                                                                                    • String ID: D:\a\1\s\Modules\_ssl.c
                                                                                                                                                                                                    • API String ID: 2720122973-132925792
                                                                                                                                                                                                    • Opcode ID: 15c5caa3e7716a4c3850000e55b75918a23e2b5d1101c2edd08794fab76a684e
                                                                                                                                                                                                    • Instruction ID: fb939dad2c2a5f0b1b2c4b641ffce10e1e5302f70b927767177ef15d00b44c9f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 15c5caa3e7716a4c3850000e55b75918a23e2b5d1101c2edd08794fab76a684e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F2F090A1B18B4282EF208F62E404729A351EFC9B95F044130DD8D87B25DFBCE0188F00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB41610 Relevance: 334.6, APIs: 95, Strings: 96, Instructions: 397COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$Constant$Object$String
                                                                                                                                                                                                    • String ID: @SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM$ALERT_DESCRIPTION_ACCESS_DENIED$ALERT_DESCRIPTION_BAD_CERTIFICATE$ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE$ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE$ALERT_DESCRIPTION_BAD_RECORD_MAC$ALERT_DESCRIPTION_CERTIFICATE_EXPIRED$ALERT_DESCRIPTION_CERTIFICATE_REVOKED$ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN$ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE$ALERT_DESCRIPTION_CLOSE_NOTIFY$ALERT_DESCRIPTION_DECODE_ERROR$ALERT_DESCRIPTION_DECOMPRESSION_FAILURE$ALERT_DESCRIPTION_DECRYPT_ERROR$ALERT_DESCRIPTION_HANDSHAKE_FAILURE$ALERT_DESCRIPTION_ILLEGAL_PARAMETER$ALERT_DESCRIPTION_INSUFFICIENT_SECURITY$ALERT_DESCRIPTION_INTERNAL_ERROR$ALERT_DESCRIPTION_NO_RENEGOTIATION$ALERT_DESCRIPTION_PROTOCOL_VERSION$ALERT_DESCRIPTION_RECORD_OVERFLOW$ALERT_DESCRIPTION_UNEXPECTED_MESSAGE$ALERT_DESCRIPTION_UNKNOWN_CA$ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY$ALERT_DESCRIPTION_UNRECOGNIZED_NAME$ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE$ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION$ALERT_DESCRIPTION_USER_CANCELLED$CERT_NONE$CERT_OPTIONAL$CERT_REQUIRED$ENCODING_DER$ENCODING_PEM$HAS_ALPN$HAS_ECDH$HAS_NPN$HAS_SNI$HAS_SSLv2$HAS_SSLv3$HAS_TLS_UNIQUE$HAS_TLSv1$HAS_TLSv1_1$HAS_TLSv1_2$HAS_TLSv1_3$HOSTFLAG_ALWAYS_CHECK_SUBJECT$HOSTFLAG_MULTI_LABEL_WILDCARDS$HOSTFLAG_NEVER_CHECK_SUBJECT$HOSTFLAG_NO_PARTIAL_WILDCARDS$HOSTFLAG_NO_WILDCARDS$HOSTFLAG_SINGLE_LABEL_SUBDOMAINS$OP_ALL$OP_CIPHER_SERVER_PREFERENCE$OP_ENABLE_MIDDLEBOX_COMPAT$OP_IGNORE_UNEXPECTED_EOF$OP_NO_COMPRESSION$OP_NO_RENEGOTIATION$OP_NO_SSLv2$OP_NO_SSLv3$OP_NO_TICKET$OP_NO_TLSv1$OP_NO_TLSv1_1$OP_NO_TLSv1_2$OP_NO_TLSv1_3$OP_SINGLE_DH_USE$OP_SINGLE_ECDH_USE$PROTOCOL_SSLv23$PROTOCOL_TLS$PROTOCOL_TLS_CLIENT$PROTOCOL_TLS_SERVER$PROTOCOL_TLSv1$PROTOCOL_TLSv1_1$PROTOCOL_TLSv1_2$PROTO_MAXIMUM_SUPPORTED$PROTO_MINIMUM_SUPPORTED$PROTO_SSLv3$PROTO_TLSv1$PROTO_TLSv1_1$PROTO_TLSv1_2$PROTO_TLSv1_3$SSL_ERROR_EOF$SSL_ERROR_INVALID_ERROR_CODE$SSL_ERROR_SSL$SSL_ERROR_SYSCALL$SSL_ERROR_WANT_CONNECT$SSL_ERROR_WANT_READ$SSL_ERROR_WANT_WRITE$SSL_ERROR_WANT_X509_LOOKUP$SSL_ERROR_ZERO_RETURN$VERIFY_ALLOW_PROXY_CERTS$VERIFY_CRL_CHECK_CHAIN$VERIFY_CRL_CHECK_LEAF$VERIFY_DEFAULT$VERIFY_X509_PARTIAL_CHAIN$VERIFY_X509_STRICT$VERIFY_X509_TRUSTED_FIRST$_DEFAULT_CIPHERS
                                                                                                                                                                                                    • API String ID: 435332665-200463448
                                                                                                                                                                                                    • Opcode ID: 4246fcb37aba479664cf045844ad5de7c1de426b030fb40a8b8529086aa4eac4
                                                                                                                                                                                                    • Instruction ID: a317d055d3d988cb2da37c06cd65580b0a749e1430d100560b36aac964338fde
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4246fcb37aba479664cf045844ad5de7c1de426b030fb40a8b8529086aa4eac4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1822E8E8B58B2391FA249F16EC546782321FF4AB91F846435CC9E06775DEADE248CF10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44FB0 Relevance: 103.6, APIs: 48, Strings: 11, Instructions: 310COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$String$Dict_$Item$List_$X509_$From$SizeUnicode_$AppendE_printO_ctrlO_freeO_getsTupleX509_get0_notY_set$AfterBeforeE_entry_countE_get_entryErr_LongLong_O_newO_s_memX509_get_issuer_nameX509_get_subject_nameX509_get_versionY_get_dataY_get_object
                                                                                                                                                                                                    • String ID: OCSP$caIssuers$crlDistributionPoints$failed to allocate BIO$issuer$notAfter$notBefore$serialNumber$subject$subjectAltName$version
                                                                                                                                                                                                    • API String ID: 558561668-857226466
                                                                                                                                                                                                    • Opcode ID: 1292bce47cf2794458cf4445570a9418f641d575f67284c696218bd56fb78f94
                                                                                                                                                                                                    • Instruction ID: e749b162ed69e26ddb468c28cb155a5e26587d329137d1c6820876e2ffd070f6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1292bce47cf2794458cf4445570a9418f641d575f67284c696218bd56fb78f94
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 43D102E5B0AB4386EE759F26A96427923A1EF85BC0F044531DECE46B74EF3CE4048B41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5160 Relevance: 82.5, APIs: 40, Strings: 7, Instructions: 245COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: free$Dealloc$Err_ErrorLastmalloc$CloseHandle$FromMemory$CharOpenProcessTokenUnicode_Wide$AccountArg_BuildCallFilenameFunctionInformationLookupObjectObject_ParseTupleValueWindowsWith__stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: (originated from %s)$GetTokenInformation$LookupAccountSidW$LookupAccountSidW -> ERROR_NONE_MAPPED$OpenProcess$OpenProcessToken$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 3415421272-2228157761
                                                                                                                                                                                                    • Opcode ID: ff8a9c1a49a510a1abc611ba67b76c801045c8d4a2ec1b8c1cc5f10a3851f7c2
                                                                                                                                                                                                    • Instruction ID: ebad2eb4dcfedcb0585daa933cf0d0345107d9d698e99712bb1b618a07699330
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ff8a9c1a49a510a1abc611ba67b76c801045c8d4a2ec1b8c1cc5f10a3851f7c2
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C8B13421B0DA4282EB949B21A85527EA3A1FF95BD6F444035DE8E4E7B4EF3CF845C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB47698 Relevance: 80.7, APIs: 35, Strings: 11, Instructions: 215threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$Warn$Dealloc$Eval_FormatModule_R_clear_errorStateStringThreadX509_X_ctrl$M_set_flagsM_set_hostflagsModuleRestoreS_client_methodS_methodS_server_methodSaveSv1_1_methodSv1_2_methodSv1_methodType_X_freeX_get0_paramX_newX_set_cipher_listX_set_optionsX_set_post_handshake_authX_set_session_id_context
                                                                                                                                                                                                    • String ID: @SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM$Cannot find internal module state$Failed to set minimum protocol 0x%x$HIGH:!aNULL:!eNULL$No cipher can be selected.$Python$invalid or unsupported protocol version %i$ssl.PROTOCOL_TLS is deprecated$ssl.PROTOCOL_TLSv1 is deprecated$ssl.PROTOCOL_TLSv1_1 is deprecated$ssl.PROTOCOL_TLSv1_2 is deprecated
                                                                                                                                                                                                    • API String ID: 2039472478-3748777976
                                                                                                                                                                                                    • Opcode ID: d8929e7f0f1c0f0d32718157f34fbf7f76c5badadc534654eca804be39bea208
                                                                                                                                                                                                    • Instruction ID: 2f0a122136773b6b14869e5912c5a08e03db9e48dd7d4803c3494ba327268062
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d8929e7f0f1c0f0d32718157f34fbf7f76c5badadc534654eca804be39bea208
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 64A12FB1A08B1392EB749F6AD95433823A1FF85B94F404536CA9E47AB0DF3CE559CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB47B00 Relevance: 70.2, APIs: 37, Strings: 3, Instructions: 200threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$DeallocR_clear_errorStringUnicode_X_set_default_passwd_cbX_set_default_passwd_cb_userdata$ConverterEval_ExceptionFreeMatchesMem_Thread_errno$Callable_CheckErrnoFormatFromRestoreSaveX_get_default_passwd_cbX_get_default_passwd_cb_userdataX_use_certificate_chain_file
                                                                                                                                                                                                    • String ID: certfile should be a valid filesystem path$keyfile should be a valid filesystem path$password should be a string or callable
                                                                                                                                                                                                    • API String ID: 3509269797-998072137
                                                                                                                                                                                                    • Opcode ID: 2a98fc2ade8fc0cf9fb732a2e4f9868c95aa16df5a789c755fed796ac59e25a6
                                                                                                                                                                                                    • Instruction ID: 39c0cf46393b061447877a8f33ca65db3e078841711b8632669b2480e8e84ed5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2a98fc2ade8fc0cf9fb732a2e4f9868c95aa16df5a789c755fed796ac59e25a6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F8A1C5F6B18B5296EB24AF61E85417923B1FF88B99B104532CE8E53A74CF3DE454CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB42084 Relevance: 64.9, APIs: 18, Strings: 19, Instructions: 120COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$ObjectWith$Err_Exception$Dealloc$BasesFromPackSpecStateTuple_Type_
                                                                                                                                                                                                    • String ID: A certificate could not be verified.$Non-blocking SSL socket needs to read more databefore the requested operation can be completed.$Non-blocking SSL socket needs to write more databefore the requested operation can be completed.$SSL/TLS connection terminated abruptly.$SSL/TLS session closed cleanly.$SSLCertVerificationError$SSLEOFError$SSLError$SSLSyscallError$SSLWantReadError$SSLWantWriteError$SSLZeroReturnError$System error when attempting SSL operation.$ssl.SSLCertVerificationError$ssl.SSLEOFError$ssl.SSLSyscallError$ssl.SSLWantReadError$ssl.SSLWantWriteError$ssl.SSLZeroReturnError
                                                                                                                                                                                                    • API String ID: 2091157252-1330971811
                                                                                                                                                                                                    • Opcode ID: eba41b414b14a5d19da5a92ffb59b808ac36444e6d063591d0875ad1b0e209c8
                                                                                                                                                                                                    • Instruction ID: 375d40e16d20a3548aaf1159b264bc627585d2a3313d6f62d286a4161ea65bfe
                                                                                                                                                                                                    • Opcode Fuzzy Hash: eba41b414b14a5d19da5a92ffb59b808ac36444e6d063591d0875ad1b0e209c8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8E5106F1A09B43A1FB619F66F9445B827A0FF49B94B405036CA8D5BA74EF3CE159CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4B104 Relevance: 63.2, APIs: 29, Strings: 7, Instructions: 236COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • _Py_BuildValue_SizeT.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B172
                                                                                                                                                                                                    • PyDict_GetItemWithError.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B18B
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B19D
                                                                                                                                                                                                    • PyErr_Occurred.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B1A8
                                                                                                                                                                                                    • PyLong_FromLong.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B1B9
                                                                                                                                                                                                    • PyDict_GetItemWithError.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B1D2
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B1E4
                                                                                                                                                                                                    • PyErr_Occurred.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B1EF
                                                                                                                                                                                                    • ERR_reason_error_string.LIBCRYPTO-3(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B20E
                                                                                                                                                                                                    • SSL_get_verify_result.LIBSSL-3(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B250
                                                                                                                                                                                                    • PyLong_FromLong.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B25A
                                                                                                                                                                                                    • X509_verify_cert_error_string.LIBCRYPTO-3(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B278
                                                                                                                                                                                                    • PyUnicode_FromString.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B286
                                                                                                                                                                                                    • PyUnicode_FromFormat.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B2AE
                                                                                                                                                                                                    • PyUnicode_FromFormat.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B2EA
                                                                                                                                                                                                    • PyUnicode_FromFormat.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B317
                                                                                                                                                                                                    • PyUnicode_FromFormat.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B339
                                                                                                                                                                                                    • PyUnicode_FromFormat.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B353
                                                                                                                                                                                                    • _Py_BuildValue_SizeT.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B389
                                                                                                                                                                                                    • PyObject_CallObject.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B3A6
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B3B9
                                                                                                                                                                                                    • PyObject_SetAttr.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B3E0
                                                                                                                                                                                                    • PyObject_SetAttr.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B402
                                                                                                                                                                                                    • PyObject_SetAttr.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B42C
                                                                                                                                                                                                    • PyObject_SetAttr.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B443
                                                                                                                                                                                                    • PyErr_SetObject.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B453
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B462
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B477
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00000000,00000000,00007FFE0EB461F0), ref: 00007FFE0EB4B48B
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: From$DeallocUnicode_$FormatObject_$Attr$Err_$BuildDict_ErrorItemLongLong_ObjectOccurredSizeValue_With$CallL_get_verify_resultR_reason_error_stringStringX509_verify_cert_error_string
                                                                                                                                                                                                    • String ID: %s (_ssl.c:%d)$Hostname mismatch, certificate is not valid for '%S'.$IP address mismatch, certificate is not valid for '%S'.$[%S: %S] %s (_ssl.c:%d)$[%S: %S] %s: %S (_ssl.c:%d)$[%S] %s (_ssl.c:%d)$unknown error
                                                                                                                                                                                                    • API String ID: 628883730-2914327905
                                                                                                                                                                                                    • Opcode ID: e9892a6f0eadcf7c9a414aa50ce525b8d324e2396194eb058d610891dae10009
                                                                                                                                                                                                    • Instruction ID: 95e69a24f15b4a3514a46a651459e7e718af2580376f818a3a7c2c845cd3e36f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e9892a6f0eadcf7c9a414aa50ce525b8d324e2396194eb058d610891dae10009
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 34A169A1B09B5682EAB59F26A89467927A0FF45F94F084435CECE17774DF3CE8498B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C63B0 Relevance: 61.4, APIs: 24, Strings: 11, Instructions: 124threadsynchronizationCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_funcfprintf$Thread$CloseCreateErr_ErrorFilenameFromHandleLastObjectSingleTerminateWaitWindowsWith__stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: (originated from %s)$CreateThread$GetExitCodeThread$GetExitCodeThread (failed) -> TerminateThread$TerminateThread$WaitForSingleObject$WaitForSingleObject -> WAIT_FAILED$WaitForSingleObject -> WAIT_FAILED -> TerminateThread$get handle name thread timed out after %i ms$psutil-debug [%s:%d]> $psutil/arch/windows\proc_handles.c
                                                                                                                                                                                                    • API String ID: 3855189052-3547020968
                                                                                                                                                                                                    • Opcode ID: 0523dddbbf0f359b339ecc5f8f441e41237c130492e52ab3eaf7a53f8a3d6bad
                                                                                                                                                                                                    • Instruction ID: b5205f59d740cdebd536eb33c4dbc07f0f5b2afc5a0dd3941c1229f14856757c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0523dddbbf0f359b339ecc5f8f441e41237c130492e52ab3eaf7a53f8a3d6bad
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DB510670A0CA0392FBD4AB25E8A53B96261EF94B81F504036D94E4E3F9EE3CE5498341
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2240 Relevance: 50.9, APIs: 24, Strings: 5, Instructions: 131COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_funcfprintf$free$BuildErrorInformationLastLogicalProcessorValue__stdio_common_vfprintfmalloc
                                                                                                                                                                                                    • String ID: GetLogicalProcessorInformationEx() count was 0$GetLogicalProcessorInformationEx() returned %u$Win < 7; cpu_count_cores() forced to None$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
                                                                                                                                                                                                    • API String ID: 3169716632-2623797460
                                                                                                                                                                                                    • Opcode ID: 65c31a4652898d8c50cc7408350ed9b36a86965c589a1fb71b747f782db4f252
                                                                                                                                                                                                    • Instruction ID: 1fc53a61eef2a1f0a6ece356f504c9ff8b05d93ae8766684db5434b982de7d4a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 65c31a4652898d8c50cc7408350ed9b36a86965c589a1fb71b747f782db4f252
                                                                                                                                                                                                    • Instruction Fuzzy Hash: EE515B31E08A4382EB949B55E8956B973A1EF85B81F44413ACD0E0F7B5DFBCE845C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48040 Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 192threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$Buffer_DeallocExceptionMatchesUnicode_$BufferConverterEval_Object_ReleaseStringThread_errno$CheckContiguousErrnoFromR_clear_errorRestoreSaveX_load_verify_locations
                                                                                                                                                                                                    • String ID: cadata should be a contiguous buffer with a single dimension$cadata should be an ASCII string or a bytes-like object$cafile should be a valid filesystem path$cafile, capath and cadata cannot be all omitted$capath should be a valid filesystem path
                                                                                                                                                                                                    • API String ID: 3554890122-3904065072
                                                                                                                                                                                                    • Opcode ID: 0f901005fbfc3df89c985eeece0820fc2da73874ba841f22b4607a7a42bbea1d
                                                                                                                                                                                                    • Instruction ID: eecc7da838a777349c8e3fdda714f627303f0dbba3ce871f596faaa996936e66
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0f901005fbfc3df89c985eeece0820fc2da73874ba841f22b4607a7a42bbea1d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 278149E2B09B4281FB799F66E95427923A1FF44B98F444035EE9E47AB4DF7CE4448B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3DE0 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 178COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_free$Memorymalloc$AdaptersAddressesDeallocDict_StringTable
                                                                                                                                                                                                    • String ID: %wS$(Oikk)$GetIfTable() syscall failed
                                                                                                                                                                                                    • API String ID: 2607516402-3214263222
                                                                                                                                                                                                    • Opcode ID: 0bbd6df0b533085c718068bf928935c8487220867ca7656e6c37901c79562546
                                                                                                                                                                                                    • Instruction ID: 8671dc56dd618158234d4ac420e5170c5ee1beb643fbb1aea48280b1fbee7737
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0bbd6df0b533085c718068bf928935c8487220867ca7656e6c37901c79562546
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CE817D71A08A8285EBE59F22A9553B963A0FF59B99F484035DE4E4F7B4DF3DE404C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8460 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 163serviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Service$Arg_CloseConfigErrorHandleLastParseQueryTuple
                                                                                                                                                                                                    • String ID: (OOOs)$QueryServiceConfigW$automatic$disabled$manual$unknown
                                                                                                                                                                                                    • API String ID: 2875933263-3989453403
                                                                                                                                                                                                    • Opcode ID: ca001a7fa07e909691af3b8a4a8a5098661b03f48719c338c56fbae38cc0f54f
                                                                                                                                                                                                    • Instruction ID: fd7c8bb8cfac4c41d04e65be8847ff03fca6e8c10fa3b5277ffc58832166dba0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ca001a7fa07e909691af3b8a4a8a5098661b03f48719c338c56fbae38cc0f54f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21614571A09B5382EBD49F22A85817963A0FF95BD5F484135CE5E0A7B4EF3CE846C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4AC74 Relevance: 47.4, APIs: 16, Strings: 11, Instructions: 143COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: J_nid2ln$BuildR_descriptionR_get_auth_nidR_get_bitsR_get_cipher_nidR_get_digest_nidR_get_idR_get_kx_nidR_get_nameR_get_versionR_is_aeadSizeValue_memset
                                                                                                                                                                                                    • String ID: aead$alg_bits$auth$description$digest$kea$name$protocol$strength_bits$symmetric${sksssssssisisOssssssss}
                                                                                                                                                                                                    • API String ID: 2466739568-4085912083
                                                                                                                                                                                                    • Opcode ID: fa5c92f24ac14b512983848be2f9f3572d78b10b24f37cd6749e73de1c1179ff
                                                                                                                                                                                                    • Instruction ID: 128d328ce8c39db8ee8030540494a0522f67db0ed2287091447a628a5b4036df
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fa5c92f24ac14b512983848be2f9f3572d78b10b24f37cd6749e73de1c1179ff
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0A61FA76A09B8685EA319F61F8543AA73A4FB88B90F540636D9DE53774EF3CE444CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C42C0 Relevance: 47.4, APIs: 18, Strings: 9, Instructions: 113COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_ParseTuple
                                                                                                                                                                                                    • String ID: GetExitCodeProcess$OpenProcess$WaitForSingleObject$WaitForSingleObject() -> WAIT_ABANDONED$WaitForSingleObject() returned WAIT_ABANDONED$WaitForSingleObject() returned WAIT_TIMEOUT$automatically set for PID 0$psutil-debug [%s:%d]> $psutil/arch/windows\proc.c
                                                                                                                                                                                                    • API String ID: 3371842430-1306819463
                                                                                                                                                                                                    • Opcode ID: f85e0826f7a185a3fb0a285266804654d7a92849d1d870d820c80c209cece6b7
                                                                                                                                                                                                    • Instruction ID: 5a14e4e079f3cdb68c0d7b6a8e2dc1f1e8c2a902fed332f761cecdbdd778b720
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f85e0826f7a185a3fb0a285266804654d7a92849d1d870d820c80c209cece6b7
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21514A75F1CA4282EB90DB25E9911B963A1FF88BD5F841032DA8E4B7B4DF2CE549C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49220 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 228threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyWeakref_GetObject.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49259
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49286
                                                                                                                                                                                                    • PyBytes_FromStringAndSize.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB492D2
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB492FC
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49342
                                                                                                                                                                                                    • SSL_get_rbio.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB4936A
                                                                                                                                                                                                    • BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB4937F
                                                                                                                                                                                                    • SSL_get_wbio.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49389
                                                                                                                                                                                                    • BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB4939A
                                                                                                                                                                                                    • _PyDeadline_Init.PYTHON311 ref: 00007FFE0EB493B6
                                                                                                                                                                                                    • PyEval_SaveThread.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB493C9
                                                                                                                                                                                                    • SSL_read_ex.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB493E1
                                                                                                                                                                                                    • PyEval_RestoreThread.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49415
                                                                                                                                                                                                    • PyErr_CheckSignals.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB4942A
                                                                                                                                                                                                    • _PyDeadline_Get.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49444
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49513
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB461AC: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE0EB461C4
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB461AC: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE0EB461F0
                                                                                                                                                                                                    • SSL_get_shutdown.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49495
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB494D9
                                                                                                                                                                                                    • _PyBytes_Resize.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB494EC
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49539
                                                                                                                                                                                                    • PyLong_FromSize_t.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE0EB491EE), ref: 00007FFE0EB49548
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Err_String$Bytes_Deadline_Eval_FromO_ctrlThread$CheckInitL_get_rbioL_get_shutdownL_get_wbioL_read_exLong_ObjectR_clear_errorR_peek_last_errorResizeRestoreSaveSignalsSizeSize_tWeakref_
                                                                                                                                                                                                    • String ID: The read operation timed out$Underlying socket connection gone$maximum length can't fit in a C 'int'$size should not be negative
                                                                                                                                                                                                    • API String ID: 2735577670-665203206
                                                                                                                                                                                                    • Opcode ID: 3e9ab01ec24f2ec9dc83e69260acb4478ff2f37a7ac4d366616528404202cf5f
                                                                                                                                                                                                    • Instruction ID: 453bb72467c86f4d01b1bc66153888e611a48b813c75e17dc43b7300da34eaa9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3e9ab01ec24f2ec9dc83e69260acb4478ff2f37a7ac4d366616528404202cf5f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 09A14CA2E09B5785FB758F65D84067A23A0FF85B98F150135CE8E47AB4DF3CE4468B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB45FB8 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 133COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Err_State_$ReleaseUnraisableWrite$ArgsCallFunctionObjectObject_$EncodedEnsureFromL_get_ex_dataL_get_servernameLongLong_OccurredUnicode_Weakref_
                                                                                                                                                                                                    • String ID: ascii
                                                                                                                                                                                                    • API String ID: 3188396730-3510295289
                                                                                                                                                                                                    • Opcode ID: 27b9578eea2e96e583f50ded47d4707f9ff0a1530b75344c49fa3ec6ab61fa5d
                                                                                                                                                                                                    • Instruction ID: 291eb6b97ed012078ff2d16fb23b7d669290f8148f8b434345b9a175f39fc584
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 27b9578eea2e96e583f50ded47d4707f9ff0a1530b75344c49fa3ec6ab61fa5d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F2510BB5A08B5286EA359F22A95423963A0FF86FD5F044435CACE07B78DF3CE445CB41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3520 Relevance: 42.1, APIs: 17, Strings: 7, Instructions: 79COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Query$CloseCounter__acrt_iob_funcfprintf$Err_FormatValue$BuildCollectDataEnglishFormattedOpenRemove__stdio_common_vfprintf
                                                                                                                                                                                                    • String ID: PdhAddEnglishCounterW failed. Performance counters may be disabled.$PdhCollectQueryData failed; assume swap percent is 0$PdhGetFormattedCounterValue failed$PdhOpenQueryW failed$\Paging File(_Total)\% Usage$psutil-debug [%s:%d]> $psutil/arch/windows\mem.c
                                                                                                                                                                                                    • API String ID: 3912788753-2726665533
                                                                                                                                                                                                    • Opcode ID: d3a1011e757affa6bd9980cb23b38eca2eb1741bab8930ecf77b4177c6165554
                                                                                                                                                                                                    • Instruction ID: 195d6acf92a6f2ae8c398407ce1f6f903cfc06c974a011c25693ca92889ecc81
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d3a1011e757affa6bd9980cb23b38eca2eb1741bab8930ecf77b4177c6165554
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C7414C75A0CA4681EB809F25E8961BA63A1FF94BD6F808132D90E4B674DE3CE54AC700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE13242260 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 202timethreadnetworkCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • _PyTime_FromSecondsObject.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132422BF
                                                                                                                                                                                                    • PyErr_ExceptionMatches.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132422D3
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE1324231F
                                                                                                                                                                                                      • Part of subcall function 00007FFE132425C8: PySequence_Fast.PYTHON311(00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132425F0
                                                                                                                                                                                                    • _PyDeadline_Init.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132423DA
                                                                                                                                                                                                    • PyEval_SaveThread.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE1324241A
                                                                                                                                                                                                    • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242423
                                                                                                                                                                                                    • select.WS2_32 ref: 00007FFE1324243D
                                                                                                                                                                                                    • PyEval_RestoreThread.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242449
                                                                                                                                                                                                    • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE1324244F
                                                                                                                                                                                                    • PyErr_CheckSignals.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE1324245E
                                                                                                                                                                                                    • _PyDeadline_Get.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242479
                                                                                                                                                                                                    • _PyTime_AsTimeval_clamp.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242497
                                                                                                                                                                                                    • PyErr_Occurred.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132424F2
                                                                                                                                                                                                    • PyTuple_Pack.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242509
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242520
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242534
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE13242548
                                                                                                                                                                                                    • WSAGetLastError.WS2_32(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132425AE
                                                                                                                                                                                                    • PyErr_SetExcFromWindowsErr.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE1324224F), ref: 00007FFE132425C0
                                                                                                                                                                                                      • Part of subcall function 00007FFE132425C8: PyObject_AsFileDescriptor.PYTHON311(?,?,00007FFE1324224F), ref: 00007FFE1324265C
                                                                                                                                                                                                      • Part of subcall function 00007FFE132425C8: PyErr_SetString.PYTHON311(?,?,00007FFE1324224F), ref: 00007FFE132426CA
                                                                                                                                                                                                      • Part of subcall function 00007FFE132425C8: _Py_Dealloc.PYTHON311(?,?,00007FFE1324224F), ref: 00007FFE132426D9
                                                                                                                                                                                                      • Part of subcall function 00007FFE132425C8: _Py_Dealloc.PYTHON311(?,?,00007FFE1324224F), ref: 00007FFE132426E8
                                                                                                                                                                                                      • Part of subcall function 00007FFE132425C8: _Py_Dealloc.PYTHON311(?,?,00007FFE1324224F), ref: 00007FFE132426FE
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
                                                                                                                                                                                                    • String ID: timeout must be a float or None$timeout must be non-negative
                                                                                                                                                                                                    • API String ID: 1581318368-2150404077
                                                                                                                                                                                                    • Opcode ID: af26c906d80cdcaef9b1c7707cf0177dbe53b8e671061a6009a46fe445b3fcbf
                                                                                                                                                                                                    • Instruction ID: 5c2a606e9e45fd2b1c5f62ff0b4f54ea1321cdb1c9194a106ae5ccf7ec4c3f32
                                                                                                                                                                                                    • Opcode Fuzzy Hash: af26c906d80cdcaef9b1c7707cf0177dbe53b8e671061a6009a46fe445b3fcbf
                                                                                                                                                                                                    • Instruction Fuzzy Hash: EB916F22A08F83D9EA25AF27E8541B963A0FFE5BA4F404175DA4D67AB8DF3CD505C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C86E0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 113serviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Service$Arg_BuildCloseErrorHandleLastParseQueryStatusTupleValue
                                                                                                                                                                                                    • String ID: (sk)$QueryServiceStatusEx$unknown
                                                                                                                                                                                                    • API String ID: 740867558-71987940
                                                                                                                                                                                                    • Opcode ID: 7a5f826723f6fb4c488f4d3a83d50b604017c63530b867749821955518b787b0
                                                                                                                                                                                                    • Instruction ID: 9835d2c104fd08fa00cf08a93fd99e1acaebfb2a69178b3de9d315bd9c364dd9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7a5f826723f6fb4c488f4d3a83d50b604017c63530b867749821955518b787b0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CC512965B1CA4682EB94DB56E84517AA3A5FF89BC4F444035DA4E4BB78EF3CE409C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44C94 Relevance: 36.2, APIs: 24, Instructions: 150COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocList_$X509_$AppendTuple$Y_set$E_entry_countE_get_entryY_get_dataY_get_object
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3918441104-0
                                                                                                                                                                                                    • Opcode ID: e1e900381a8d91718b823929a8936b5640ec206a8770a063c5ab20c7e35ac350
                                                                                                                                                                                                    • Instruction ID: dc2d264bdd4b575dacf77d8d9929ec3ad6948de7b34ee9085a552caa08ed0379
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e1e900381a8d91718b823929a8936b5640ec206a8770a063c5ab20c7e35ac350
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6C511FE1A4DB0281EE399F36A95823962E1EF45FD5F080434CE9E46770EF3CE4558B01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44A34 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 137COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: R_clear_errorR_peek_last_error$E_add_certErr_M_read_bio_O_freeO_new_mem_bufStringX509X509_X509_bioX509_freeX_get_cert_storeX_get_default_passwd_cbX_get_default_passwd_cb_userdatad2i_
                                                                                                                                                                                                    • String ID: Can't allocate buffer$Certificate data is too long.$Empty certificate data$no start line: cadata does not contain a certificate$not enough data: cadata does not contain a certificate
                                                                                                                                                                                                    • API String ID: 3308083359-3246380861
                                                                                                                                                                                                    • Opcode ID: 50f81ea1cc574accf7e719c4ea89de3f746a30d8db88f1569ab38cc467b8a051
                                                                                                                                                                                                    • Instruction ID: 25116042f28e257ede723d8629d8f410174a8fd271e1d4c77e478216add86da3
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 50f81ea1cc574accf7e719c4ea89de3f746a30d8db88f1569ab38cc467b8a051
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 96517CE2A0CB4781FB749F16A85033972A1EF85B98F244531DEAE867B4DE3CE4558A01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3770 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 130COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocDict_free$BuildCharEntry2FromItemUnicode_ValueWidemalloc
                                                                                                                                                                                                    • String ID: (KKKKKKKK)$GetIfEntry() or GetIfEntry2() syscalls failed.
                                                                                                                                                                                                    • API String ID: 1733073734-1738093298
                                                                                                                                                                                                    • Opcode ID: 89ba76a1b72666b364fd6e0024d101e9a52eeb5c014b9f6945bdb18c31e6aa4c
                                                                                                                                                                                                    • Instruction ID: ff13c289aad80528a470004c9999a69ee955405491b700f1bbc6c185430c722f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 89ba76a1b72666b364fd6e0024d101e9a52eeb5c014b9f6945bdb18c31e6aa4c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3C514A71A09B8685EBD49F25A8442B923A4FF58FD9F488535CE8E4B7B4EF3CE4458700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2850 Relevance: 33.3, APIs: 14, Strings: 5, Instructions: 96memoryCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err___acrt_iob_funcfprintf$FromWindows$AllocLocalString
                                                                                                                                                                                                    • String ID: CallNtPowerInformation syscall failed$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
                                                                                                                                                                                                    • API String ID: 2295254528-3941425547
                                                                                                                                                                                                    • Opcode ID: fd1dfc5c52d94558bcbb6022db89810566aa823dc1beec5d09e06ad5ea860373
                                                                                                                                                                                                    • Instruction ID: 688a94727026be2fbea7f92603d5217a4f7ff422de9ec6b06966c86ca8d792f8
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fd1dfc5c52d94558bcbb6022db89810566aa823dc1beec5d09e06ad5ea860373
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CF413E75F08A1282FB849B61E89567963A1FF88BD5F040439CA4E4B7B4DF7CE986C710
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A628 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Bytes_DeallocDecodeDefaultFromStringUnicode_$BuildSizeValue_X509_get_default_cert_dirX509_get_default_cert_dir_envX509_get_default_cert_fileX509_get_default_cert_file_env
                                                                                                                                                                                                    • String ID: NNNN
                                                                                                                                                                                                    • API String ID: 3186749377-3742719684
                                                                                                                                                                                                    • Opcode ID: 5812523e17acacd3d56aa4f8161c98e7c93a552db994b69a6363573059e52f0b
                                                                                                                                                                                                    • Instruction ID: a6c99d025d2da46efe6daed77006ad1541cac96c5d0132aacb0b9cf6045d0430
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5812523e17acacd3d56aa4f8161c98e7c93a552db994b69a6363573059e52f0b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4B51E7A9A4EB5781FA769F26A95413863B0EF55F94B084434CECE07774FE3CE9419B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44778 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 78threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$Eval_FetchState_Thread_errno$EnsureErrnoFilenameFromL_get_ex_dataO_ctrlO_printfObjectReleaseRestoreSaveStringThread_acquire_lockThread_allocate_lockThread_release_lockWith
                                                                                                                                                                                                    • String ID: %s$Unable to allocate lock
                                                                                                                                                                                                    • API String ID: 2873158514-852672932
                                                                                                                                                                                                    • Opcode ID: d7c58ab23655fdf53652f9103697f81efa9e0fb6b151a80ecc83c58c26844ad8
                                                                                                                                                                                                    • Instruction ID: 112eff2e84bbb09d128e2ea15f3bddd07fdc6f2ab324bd52d95764c6165a5c59
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d7c58ab23655fdf53652f9103697f81efa9e0fb6b151a80ecc83c58c26844ad8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CA41B5B6A18F4682EB209F26E85427973B0FB88B95F445131CA8E53774DF7CE499CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7860 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 86COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C788E
                                                                                                                                                                                                    • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C789D
                                                                                                                                                                                                    • EnumProcesses.PSAPI(?,?,?,?,?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C78B5
                                                                                                                                                                                                    • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C78F2
                                                                                                                                                                                                    • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE014C7CCD,?,?,?,00007FFE014C4116), ref: 00007FFE014C7902
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: free$EnumProcessesmalloc
                                                                                                                                                                                                    • String ID: psutil-debug [%s:%d]> $psutil/arch/windows\proc_utils.c$psutil_get_pids() failed
                                                                                                                                                                                                    • API String ID: 3948894879-1935701007
                                                                                                                                                                                                    • Opcode ID: 5b819d701f38979888defde3c16bc387b673110d1013305d54a5195e50bad253
                                                                                                                                                                                                    • Instruction ID: 20c14a4233623c70d660dc5375e3370910b0c024a43fcfe7980d4700a375d32d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5b819d701f38979888defde3c16bc387b673110d1013305d54a5195e50bad253
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 96312D35E0864282FB94AF25A8552BA7261EF85BD2F184036DE4E0E3B5DE3CE885C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB43BAC Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 160COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: R_clear_error$Err_FromObjectR_peek_last_errorWeakref_Windows
                                                                                                                                                                                                    • String ID: A failure in the SSL library occurred$EOF occurred in violation of protocol$Invalid error code$Some I/O error occurred$TLS/SSL connection has been closed (EOF)$The operation did not complete (X509 lookup)$The operation did not complete (connect)$The operation did not complete (read)$The operation did not complete (write)
                                                                                                                                                                                                    • API String ID: 2320205569-3413158800
                                                                                                                                                                                                    • Opcode ID: 4890fb423e0a5cc41f3507ce645631016807d6c00835e9578a328920756af035
                                                                                                                                                                                                    • Instruction ID: fbd56a78ab42f261697a178ad9304e7dcb5b4c5519dab16091f1f87a636af081
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4890fb423e0a5cc41f3507ce645631016807d6c00835e9578a328920756af035
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 50617BA2A0CB4692EB74AF16A84467923E5FF44B40F584535CE9D277B8CE3DF8498B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5D90 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 136COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandleQueryVirtual$Arg_CharFileFromList_MappedNameParseTupleUnicode_Wide
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1797541475-341566991
                                                                                                                                                                                                    • Opcode ID: df787f5785b03c89030cf278b7e5ae82fcca85010b4fb67abe153575bba40a8d
                                                                                                                                                                                                    • Instruction ID: 1ed2f1594802775e0b7692c0c5a625193b9ef5d6015bc8cb89a9452fa551205e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: df787f5785b03c89030cf278b7e5ae82fcca85010b4fb67abe153575bba40a8d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E3516C21B0AB8285EB989B22A46427D63A4FF44BD5F484136EE4E4F7B4EF3CE405C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8DB0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 92COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_ExtendedTable$MemoryStringfreemalloc
                                                                                                                                                                                                    • String ID: GetExtendedUdpTable failed$GetExtendedUdpTable: retry with different bufsize$psutil-debug [%s:%d]> $psutil/arch/windows\socks.c
                                                                                                                                                                                                    • API String ID: 70375929-1528784589
                                                                                                                                                                                                    • Opcode ID: 13433dedefb041b541058e9ea630bd3063787760f6f6367a059fd7b71bf197ec
                                                                                                                                                                                                    • Instruction ID: 5857cf5f7ffee203cd41d80be9e4ceb31a168e2315dc506c80a780b192404f4d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 13433dedefb041b541058e9ea630bd3063787760f6f6367a059fd7b71bf197ec
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E741A075F0860282EB949B19F8542BAA3A1FF88BD4F084036DE4D4B775DF7CE4858B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8C30 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 92COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_ExtendedTable$MemoryStringfreemalloc
                                                                                                                                                                                                    • String ID: GetExtendedTcpTable failed$GetExtendedTcpTable: retry with different bufsize$psutil-debug [%s:%d]> $psutil/arch/windows\socks.c
                                                                                                                                                                                                    • API String ID: 70375929-1350966821
                                                                                                                                                                                                    • Opcode ID: f239a94d76ab10aad535b2cd237feaf49fe0d827588dd12344b3a13b8920aeed
                                                                                                                                                                                                    • Instruction ID: 5af73bc1238921872fa1c70acdb5d48072039a1b2b6a393b20e8a7437a46ee60
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f239a94d76ab10aad535b2cd237feaf49fe0d827588dd12344b3a13b8920aeed
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 83417176A0CA0282EB949B19F85427AA3A1FF89BD4F180036DE4D4B775DF7CE4858B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB443C4 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 78threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Thread$O_ctrlRestoreSaveX_set_keylog_callback$DeallocErr_O_free_allO_new_fpO_putsPy_fopen_objString
                                                                                                                                                                                                    • String ID: # TLS secrets log file, generated by OpenSSL / Python$Can't malloc memory for keylog file
                                                                                                                                                                                                    • API String ID: 2661017659-2802485923
                                                                                                                                                                                                    • Opcode ID: 05ed5b3aa52d5d4895ad906bc6b9f8271c6f142caf074fdeb1ca44e36a35320a
                                                                                                                                                                                                    • Instruction ID: e9581f62ed76b33751cee644cff0ff69e9b8d9549dad46dcef13fe1519e0349c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 05ed5b3aa52d5d4895ad906bc6b9f8271c6f142caf074fdeb1ca44e36a35320a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 403126B6A08B0292EB649F25E95437923A1FF88B94F445531CB9E07A74DF3CF5A5CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB45484 Relevance: 27.1, APIs: 18, Instructions: 103COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • X509_get_ext_d2i.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB454AA
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB454BB
                                                                                                                                                                                                    • AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB454C8
                                                                                                                                                                                                    • PyList_New.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB454F0
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45507
                                                                                                                                                                                                    • OPENSSL_sk_value.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45516
                                                                                                                                                                                                    • OBJ_obj2nid.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45522
                                                                                                                                                                                                    • PyUnicode_FromStringAndSize.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45541
                                                                                                                                                                                                    • PyList_Append.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45559
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB4556B
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB4557B
                                                                                                                                                                                                    • AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45588
                                                                                                                                                                                                    • PyList_Size.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB45591
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB455A9
                                                                                                                                                                                                    • PyList_AsTuple.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB455B7
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB455C9
                                                                                                                                                                                                    • AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB455DA
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,00000000,00000000,00007FFE0EB4539B), ref: 00007FFE0EB455EE
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocList_$L_sk_numS_free$Size$AppendFromJ_obj2nidL_sk_valueStringTupleUnicode_X509_get_ext_d2i
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 230305477-0
                                                                                                                                                                                                    • Opcode ID: 3a585c1c262227830be3f02465c1959d4561547932cce4ab8a18f59093ed3fc3
                                                                                                                                                                                                    • Instruction ID: 35d0ff3ac11e53a9b98dc0deaa00d25d49bbdbe7934edfffed99a17a613fc70f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3a585c1c262227830be3f02465c1959d4561547932cce4ab8a18f59093ed3fc3
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4E41FCA1B0AB4682FA759F26A95423923A1EF84FD5B184434CECE46B74EF3CE4458B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7050 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 135COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Arg_ArgvBuildCallCloseCommandErr_ErrorFunctionHandleKeywordsLastLineObjectObject_OpenParseProcessTupleValuefree
                                                                                                                                                                                                    • String ID: CommandLineToArgvW$i|O$psutil_pid_is_running -> 0
                                                                                                                                                                                                    • API String ID: 3844243672-3353757699
                                                                                                                                                                                                    • Opcode ID: 51e6f2cc3e47cdcad9e607cfcb69c2d76aeda8354bc9d8735d650d2502fcfd5f
                                                                                                                                                                                                    • Instruction ID: 5e96b5caaf476746b7dec7dd1000a88be447050ae91dfa515c8ebeb828724226
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 51e6f2cc3e47cdcad9e607cfcb69c2d76aeda8354bc9d8735d650d2502fcfd5f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: AB518031A09A4686EBD19F25A8451B973A5FF84BE2F444131DE5E4B7B4EF3CE445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46354 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 73COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: O_free$Err_String$DecodeM_write_bio_ModuleO_ctrlO_newO_s_memR_clear_errorR_peek_last_errorStateType_Unicode_X509_X509_bioi2d_
                                                                                                                                                                                                    • String ID: Unsupported format$error$failed to allocate BIO$i
                                                                                                                                                                                                    • API String ID: 629801032-3389475273
                                                                                                                                                                                                    • Opcode ID: 94ff7831c67621cd067be57099dcd6dd47ac53a07c68cafb9bb48cf750901b58
                                                                                                                                                                                                    • Instruction ID: 8d3c58473dc1abf7c7cc03eb9d22528ee71e9e627f2524695d06b0ae8d60a2e2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 94ff7831c67621cd067be57099dcd6dd47ac53a07c68cafb9bb48cf750901b58
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 62311AE1B08B4782EA349F2AF9541396361FF86B84F584035DA8E47B79CE3CE4458A40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB42388 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 67COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$BuildFromOpenSizeValue_$L_versionL_version_numLongLong_StringUnicode_Unsigned
                                                                                                                                                                                                    • String ID: IIIII$OPENSSL_VERSION$OPENSSL_VERSION_INFO$OPENSSL_VERSION_NUMBER$_OPENSSL_API_VERSION
                                                                                                                                                                                                    • API String ID: 1934562181-595941748
                                                                                                                                                                                                    • Opcode ID: 228d6267ba487b7e7cdb259f7e413d65acd9f72b2f9f06f6296928d9bd0b9633
                                                                                                                                                                                                    • Instruction ID: a6a777b09663e174836a8c206968a05821201f34bd43387b5548f027bbb841e5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 228d6267ba487b7e7cdb259f7e413d65acd9f72b2f9f06f6296928d9bd0b9633
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D8218DB5F1875382FB208F66E85456927A1FF85B94B400535DA8E4BAB4DE3CE148CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C6940 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 66COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_funcfprintf$CallDeallocErr_FunctionObjectObject___stdio_common_vfprintf__stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: %s -> ERROR_NOACCESS$(is)$ReadProcessMemory$assume access denied (originated from %s)$psutil-debug [%s:%d]> $psutil/arch/windows\proc_info.c
                                                                                                                                                                                                    • API String ID: 3932792662-3282842418
                                                                                                                                                                                                    • Opcode ID: eaea69a0fd08df27dee9ce44a516821b22dc12c5c784207db60bb2ee48d24e3b
                                                                                                                                                                                                    • Instruction ID: 77f9cf7a3f4ffe67c3a45aa25c271001575e498de79aaffd5f8a36a15fd0ea24
                                                                                                                                                                                                    • Opcode Fuzzy Hash: eaea69a0fd08df27dee9ce44a516821b22dc12c5c784207db60bb2ee48d24e3b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 92313065B08A82C1EB90DB15E8553F96360FF98BC4F804036D94E0F7B6DE2CE505C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C88F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 107serviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Service$Arg_BuildCloseConfig2ErrorHandleLastParseQueryTupleValue
                                                                                                                                                                                                    • String ID: QueryServiceConfig2W
                                                                                                                                                                                                    • API String ID: 40459686-608009358
                                                                                                                                                                                                    • Opcode ID: 38ebdd41191bb4eeaf42879d70dd1b27020a26cfd0b3f07b28e0f92539f0d512
                                                                                                                                                                                                    • Instruction ID: df63e300a9ecaa5d06541fc3c0a5c5ee27d12f683a876c7486c9a400b72cc897
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 38ebdd41191bb4eeaf42879d70dd1b27020a26cfd0b3f07b28e0f92539f0d512
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DE415F62A0DB8682EB818F16E8501797770FB85BD4F484131DA8D4BBB5DF3DE449C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49E88 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • a2i_IPADDRESS.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49ECD
                                                                                                                                                                                                    • ERR_clear_error.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49EDB
                                                                                                                                                                                                    • PyUnicode_Decode.PYTHON311(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49EF5
                                                                                                                                                                                                    • SSL_ctrl.LIBSSL-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49F1A
                                                                                                                                                                                                    • SSL_get0_param.LIBSSL-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49F51
                                                                                                                                                                                                    • X509_VERIFY_PARAM_set1_host.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49F72
                                                                                                                                                                                                    • ASN1_STRING_length.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49F89
                                                                                                                                                                                                    • ASN1_STRING_get0_data.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49F95
                                                                                                                                                                                                    • X509_VERIFY_PARAM_set1_ip.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49FA4
                                                                                                                                                                                                    • ASN1_OCTET_STRING_free.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49FD4
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,?,?,00000000,00007FFE0EB4B8D3,?,?,?,?,00007FFDFB926CC8,?,00000000,00007FFE0EB4707D), ref: 00007FFE0EB49FED
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: X509_$DecodeErr_G_freeG_get0_dataG_lengthL_ctrlL_get0_paramM_set1_hostM_set1_ipR_clear_errorStringUnicode_a2i_
                                                                                                                                                                                                    • String ID: ascii$server_hostname cannot be an empty string or start with a leading dot.$strict
                                                                                                                                                                                                    • API String ID: 2286705765-138613600
                                                                                                                                                                                                    • Opcode ID: 5d2bfde28ef6c6392bab384c5f06137cb2eb952a154b8e2bbead59b995bbe33b
                                                                                                                                                                                                    • Instruction ID: f96eae0aefed80acaf32d94385a8950d332b6f1c06f43d8a0134ec6a715b1d36
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5d2bfde28ef6c6392bab384c5f06137cb2eb952a154b8e2bbead59b995bbe33b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 584109A2A08B8382EB358F56A55423A67A1FF85F94F044135DACE47BB4EF7DF4458B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A6490 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CertElementErr_Error@@KeywordsParseSerializeStoreStringTupleU_object@@Win_
                                                                                                                                                                                                    • String ID: CertSerializeCTLStoreElement$The certificate trust context has been closed$Unable to allocate %d bytes$|k:CertSerializeCTLStoreElement
                                                                                                                                                                                                    • API String ID: 2109812038-2971064172
                                                                                                                                                                                                    • Opcode ID: 510c4899f38fdeb9faecca273dd8be041beb8aff3d436e3cbb2d9de04d79ea5f
                                                                                                                                                                                                    • Instruction ID: 7fa9745ea4b6c138c20e3955b0be2fdbf1530ee4e6f47dd0f0a5c88ac645075b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 510c4899f38fdeb9faecca273dd8be041beb8aff3d436e3cbb2d9de04d79ea5f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 18310C36A58A5282EB00CF5AF860069A372FF88BD4B544032DB4E43778DF3DE546CB08
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C9EB0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$FormatQuery$CollectCounterCreateDataEnglishErrorEventFilenameFromLastOpenWindowsWith
                                                                                                                                                                                                    • String ID: CreateEventW$LoadUpdateEvent$PdhAddEnglishCounterW failed. Performance counters may be disabled.$PdhCollectQueryDataEx failed$PdhOpenQueryW failed$RegisterWaitForSingleObject$\System\Processor Queue Length
                                                                                                                                                                                                    • API String ID: 646616500-2122461562
                                                                                                                                                                                                    • Opcode ID: c538e066b9ffb4ef43d50bb76fbe220dcfd8b65343e51e0986a240f06ba2bb53
                                                                                                                                                                                                    • Instruction ID: 43bdb15ace1efe91450468e4f9a1f70c5b45bcf3b36b5fad64e63b6f444a667c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c538e066b9ffb4ef43d50bb76fbe220dcfd8b65343e51e0986a240f06ba2bb53
                                                                                                                                                                                                    • Instruction Fuzzy Hash: AB312E65B08A4792EB90DF61E8511AAA3A1FF88BD9F844032DA0D4B7B4DF3CE545C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46914 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 85COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Buffer_$Arg_$ArgumentBufferCheckContiguousDoubleErr_FillFloat_InfoObject_OccurredPositionalReleaseSizeUnicode_memset
                                                                                                                                                                                                    • String ID: RAND_add$argument 1$contiguous buffer
                                                                                                                                                                                                    • API String ID: 2392993315-868614225
                                                                                                                                                                                                    • Opcode ID: 760704bb7d48e9af809a327266635d964fcbd7f8d53c73b090e1ceb7c6f7a998
                                                                                                                                                                                                    • Instruction ID: 12b509ddba1b4f9cbc66e3afb1a3df5732a65c5e21e950b11f1fd43797dec41e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 760704bb7d48e9af809a327266635d964fcbd7f8d53c73b090e1ceb7c6f7a998
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 82415BA6B18F8681EB709F25E8443B963A0FF95B84F948031DA8D53678DF3CE945CB41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB43A9C Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: SizeString$BuildBytes_D_bytesErr_FromValue_
                                                                                                                                                                                                    • String ID: (ks)$num must be positive
                                                                                                                                                                                                    • API String ID: 413208185-3708576348
                                                                                                                                                                                                    • Opcode ID: 5413d4b00cf62b1f91e158371b34f37916e9ebd3c6ab2f0718aebc8591ef1ccf
                                                                                                                                                                                                    • Instruction ID: 12726eb0e4aba9a519bacc83df0bcc0e1a529a0b08712626915cfa5c82772b1e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5413d4b00cf62b1f91e158371b34f37916e9ebd3c6ab2f0718aebc8591ef1ccf
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4D310AA1F0CB5281EB749F65E85827963F1EF88B90F584436CA8E47774DE3CE8458B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49D94 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 64COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: String$Bytes_DeallocErr_M_read_bio_Module_O_ctrlO_freeO_newO_s_fileStateX509X509_free
                                                                                                                                                                                                    • String ID: Can't malloc memory to read file$Can't open file$Error decoding PEM-encoded file
                                                                                                                                                                                                    • API String ID: 2561677103-2145957498
                                                                                                                                                                                                    • Opcode ID: 36725f3dc204c9153c7cc54b9da455b65a3a919f56e201ff7c03204d9d0b156b
                                                                                                                                                                                                    • Instruction ID: 4c05bec282c5eee4c896297d46c1434b8757b4f23445a58000f9f8f93cc590b9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 36725f3dc204c9153c7cc54b9da455b65a3a919f56e201ff7c03204d9d0b156b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 03213AA1B09B4382FA349F66A95463A73A0FF85F91B489031DE8E17B74DF3CE4558B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB472D4 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 63COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: X509_$L_sk_num$BuildE_get0_objectsL_sk_valueSizeT_get0_T_get_typeValue_X509X509_check_caX_get_cert_store
                                                                                                                                                                                                    • String ID: crl$x509$x509_ca${sisisi}
                                                                                                                                                                                                    • API String ID: 3289807285-1814362494
                                                                                                                                                                                                    • Opcode ID: 34f657cc2ea798cf1d8222288ace4f96e85442a26bbc834ed173ff761f84965a
                                                                                                                                                                                                    • Instruction ID: 1ce5860a9c517ce88aa0e500c5fd89f4a79e7586c8203f67c15d3c1cc9185a98
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 34f657cc2ea798cf1d8222288ace4f96e85442a26bbc834ed173ff761f84965a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 922129B2A08B1386EA309F66A84417A67A0FB88B90F544536DDDE47335DF3CE556CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB455FC Relevance: 21.1, APIs: 14, Instructions: 97COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • X509_get_ext_d2i.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45623
                                                                                                                                                                                                    • PyList_New.PYTHON311(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB4563F
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45656
                                                                                                                                                                                                    • OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45669
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45681
                                                                                                                                                                                                    • OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45691
                                                                                                                                                                                                    • PyUnicode_FromStringAndSize.PYTHON311(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB456A7
                                                                                                                                                                                                    • PyList_Append.PYTHON311(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB456BB
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB456CD
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB456DE
                                                                                                                                                                                                    • OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB456EE
                                                                                                                                                                                                    • PyList_AsTuple.PYTHON311(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45705
                                                                                                                                                                                                    • _Py_Dealloc.PYTHON311(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45720
                                                                                                                                                                                                    • CRL_DIST_POINTS_free.LIBCRYPTO-3(?,?,00000000,00007FFE0EB45432), ref: 00007FFE0EB45729
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: L_sk_num$List_$DeallocL_sk_value$AppendFromS_freeSizeStringTupleUnicode_X509_get_ext_d2i
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3668485020-0
                                                                                                                                                                                                    • Opcode ID: 3320d0f1129c619412700790f9a094c5812d08af16af03b4be33707a097b3e6c
                                                                                                                                                                                                    • Instruction ID: b2bbbff36db7ff980079ee82d192b9010200c5fc0810a82e6e5a0cfa2f2b406b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3320d0f1129c619412700790f9a094c5812d08af16af03b4be33707a097b3e6c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CA3159A5B0AB4682EA349F66A95413963A0FF84FD5B444835DE8E47B70EF3CE446CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A8D0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 60COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$MallocMem_MemoryStringi2d_
                                                                                                                                                                                                    • String ID: Invalid session$d2i() failed$i2d() failed
                                                                                                                                                                                                    • API String ID: 982646903-2456513230
                                                                                                                                                                                                    • Opcode ID: 5025dd38f3ee393e1dcb654bb9a39eed9e2094fe50bb50b157184c55e23c2b69
                                                                                                                                                                                                    • Instruction ID: 99792247bbd6fdf9532ae43766238baa52b1701ccd9771fd2a32c9f80149d98a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5025dd38f3ee393e1dcb654bb9a39eed9e2094fe50bb50b157184c55e23c2b69
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 622114B1B4DB0291EB799F26E89413963A0FF88B90B455435DACE46BB4EF3CE4458B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4746C Relevance: 19.6, APIs: 13, Instructions: 86COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocX509_$L_sk_numList_$AppendE_get0_objectsL_sk_valueT_get0_T_get_typeX509X509_check_caX_get_cert_store
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2012148854-0
                                                                                                                                                                                                    • Opcode ID: 4772bb9924977a59d590962b82a9349e1da933cf390f521ff6c1ac576cdbf3a6
                                                                                                                                                                                                    • Instruction ID: c2ad487634b01a29b4005d2f5bb338127a9aa055fc1349ec541241f6989b2af2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4772bb9924977a59d590962b82a9349e1da933cf390f521ff6c1ac576cdbf3a6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B43158A1B09B2285EE359F26A95423D63A1EF89FD1B040835DD9E4B7B4EF3CE441CB41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4B9E4 Relevance: 19.6, APIs: 13, Instructions: 84encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$CertEnhancedErrorFromLastMallocMem_MemoryUsageWindows
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2062549779-0
                                                                                                                                                                                                    • Opcode ID: 6ccdf2e6da418b71ee6a277c338430505177ae2aaa9e9ea6467fc54b7af40cb9
                                                                                                                                                                                                    • Instruction ID: 2271347784b26e37137265e1dde16f0e3fbc4bc59e2cd99b83bca2ea80b91529
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6ccdf2e6da418b71ee6a277c338430505177ae2aaa9e9ea6467fc54b7af40cb9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5B310CA1A0DB4296FA759F66A89817D63E0FF48B90B044435DFCE427B0DF3CE8458B81
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4BBB8 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$Arg_FormatParse_SizeStringWarnX_ctrl
                                                                                                                                                                                                    • String ID: The context's protocol doesn't support modification of highest and lowest version.$Unsupported TLS/SSL version 0x%x$Unsupported protocol version 0x%x$ssl.TLSVersion.SSLv3 is deprecated$ssl.TLSVersion.TLSv1 is deprecated$ssl.TLSVersion.TLSv1_1 is deprecated
                                                                                                                                                                                                    • API String ID: 1675272777-3879554506
                                                                                                                                                                                                    • Opcode ID: 3d9b3b6d3e36b2be8caeff61d41c0550b43c85a0ce4765ee1e569fe56bc38d30
                                                                                                                                                                                                    • Instruction ID: 21f437b6de089e573a0fed79270a81a635832d023de31c5df4d16a89580e4ec9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3d9b3b6d3e36b2be8caeff61d41c0550b43c85a0ce4765ee1e569fe56bc38d30
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 74414FA1F1CB1281FA748F1DD8D4A393661EF817A4F644232CB9D42AF5CE6DE9858F01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB45DEC Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_String$DeallocMem_$FormatFreeMallocUnicode_memcpy
                                                                                                                                                                                                    • String ID: password cannot be longer than %d bytes$unable to allocate password buffer
                                                                                                                                                                                                    • API String ID: 1570515377-2395793021
                                                                                                                                                                                                    • Opcode ID: 1fedb40cc1d486ec5199c1867a2372f2c12813202da2ce569f2c6c6631ea6d3e
                                                                                                                                                                                                    • Instruction ID: 277479acc442199e8d73c208e6702b98b5f0c285aec4d578bb00c786da44917b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1fedb40cc1d486ec5199c1867a2372f2c12813202da2ce569f2c6c6631ea6d3e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6341F9B2B09F0686EA349F26A84417863A5FB89FD0B584031DEDE47BB5DE3CE4458B41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4900 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 77COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_HandleProcess$Arg_BuildCallDeallocErrorFromFunctionInfoLastMemoryObjectObject_OpenParseTupleValueWindows
                                                                                                                                                                                                    • String ID: (kKKKKKKKKK)$OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 3753264371-2652395995
                                                                                                                                                                                                    • Opcode ID: 8560fa649741087e39816c3eedeadae9955d971fac951e8a7d026582e910fb55
                                                                                                                                                                                                    • Instruction ID: cb33d116f49500bdf88ce2f93915fc3e8a26cd0be356398e1fef4d7b5d1201cd
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8560fa649741087e39816c3eedeadae9955d971fac951e8a7d026582e910fb55
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0B31E13160DB8681EBA09B25F9913AA73A5FB88BC4F544135DA8D4B779DF3CE445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46474 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ModuleModule_StateType_$Arg_$KeywordsPositional
                                                                                                                                                                                                    • String ID: MemoryBIO
                                                                                                                                                                                                    • API String ID: 1528309267-1677681617
                                                                                                                                                                                                    • Opcode ID: 6a28ea5c73267c1f6487f13ce1529defaead614994a34bcabae3c0cd9527e803
                                                                                                                                                                                                    • Instruction ID: a9adc009c4218f8b8ba92fb7b94d63dbcdb2e78288944cf4dba661362aed2351
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6a28ea5c73267c1f6487f13ce1529defaead614994a34bcabae3c0cd9527e803
                                                                                                                                                                                                    • Instruction Fuzzy Hash: FD3106B6B09B0692EA64DF12E94427863A1FB89F80F485071CA9E57778DF3CE455CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5900 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_HandleProcess$Arg_BuildCallCountersDeallocErrorFromFunctionLastObjectObject_OpenParseTupleValueWindows
                                                                                                                                                                                                    • String ID: (KKKKKK)$OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 1543235388-302434769
                                                                                                                                                                                                    • Opcode ID: 16925b249932089b065d8323e6d1c6704f0cd95648b3c78916a056828a5aaa93
                                                                                                                                                                                                    • Instruction ID: 0f7773638b5586aab02d52e978b52589868a4614e1c26fafea81294798f239f5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 16925b249932089b065d8323e6d1c6704f0cd95648b3c78916a056828a5aaa93
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1431FE61B0DB4682EB90DB26E4513BDA3A1FF89BD1F544035DA8D4F775DE2CE4458700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0AB89C Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 68COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BufferBuildFreeMem_ReferenceValueView@@malloc
                                                                                                                                                                                                    • String ID: CertStore$ContentType$Context$FormatType$Msg$MsgAndCertEncodingType${s:k,s:k,s:k,s:N,s:N,s:N}
                                                                                                                                                                                                    • API String ID: 3234142203-3520626638
                                                                                                                                                                                                    • Opcode ID: be5ba9cf2c52ab8c6484f8d0f5f192128bd78cf0806263e4d257c599e1124afa
                                                                                                                                                                                                    • Instruction ID: f6b4612e8730cae1339aeabc083cdf32469033a5ca27b449700ec18c0c2725a9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: be5ba9cf2c52ab8c6484f8d0f5f192128bd78cf0806263e4d257c599e1124afa
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F310536A88B4686EB11CF59E8601AC73B6FF48B94B541136DA8E13B78DF3CE455C708
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8080 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 58serviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_ErrorFilenameFromLastOpenServiceWindowsWith$CloseHandleManager__stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: (originated from %s)$OpenSCManager$OpenService
                                                                                                                                                                                                    • API String ID: 4285539973-532727491
                                                                                                                                                                                                    • Opcode ID: 074a8156b23cb10fa8405d4164f2764c3fb920c734cfa85fdee803530eb578bf
                                                                                                                                                                                                    • Instruction ID: d68c4fad235b4781af6fa66e1015f3ba3b50a62a06fb85f3e7f2d81dbd24d236
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 074a8156b23cb10fa8405d4164f2764c3fb920c734cfa85fdee803530eb578bf
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F52163A5B1CA4792EB909B22E8553B923A1FF8CBC9F804031DD4E4F775EE2CE5098700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7D10 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 30COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_funcfprintf$Err_ErrorLastWarn__stdio_common_vfprintf
                                                                                                                                                                                                    • String ID: psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker$psutil-debug [%s:%d]> $psutil/arch/windows\security.c
                                                                                                                                                                                                    • API String ID: 306901517-4141899461
                                                                                                                                                                                                    • Opcode ID: 9bdf8c3ca8b4194c9c734bb658b1f7f3a31d4ff80eb6b812a16c9c8a2d4a6292
                                                                                                                                                                                                    • Instruction ID: a8ceb069ee41f7a198a4c8d8f5f124268e477300c8fa230c7b3da5324c5ff49a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9bdf8c3ca8b4194c9c734bb658b1f7f3a31d4ff80eb6b812a16c9c8a2d4a6292
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6801BB31E08A4282F794AB15EC962B57262EF45BD6F400136C80E0F2B6DE6DB586C791
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB47E34 Relevance: 18.1, APIs: 12, Instructions: 72threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_H_freeThread_errno$Err_ErrnoFilenameFromHparamsM_read_ObjectPy_fopen_objR_clear_errorRestoreSaveWithX_ctrlfclose
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1346594628-0
                                                                                                                                                                                                    • Opcode ID: 9fb57a25fe52b83528d097f4dfeaca7513a484f3675f1820dd0a3e9022f9a58c
                                                                                                                                                                                                    • Instruction ID: dcf7ea304d5ba781cd94714c0c100d48214326b331618e8370b600ff8853caa6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9fb57a25fe52b83528d097f4dfeaca7513a484f3675f1820dd0a3e9022f9a58c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 963106B6A18BA286E7209F66E85852963A0FF88B95B454531DECE43B74DF3CE445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A7C60 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_String$Arg_Keywords_ParseSizeTuple
                                                                                                                                                                                                    • String ID: CRYPT_SIGN_MESSAGE_PARA: HashAuxInfo parm not yet supported$CRYPT_SIGN_MESSAGE_PARA: MsgCrl parm not yet supported$OO|OOOOOkkk:CRYPT_SIGN_MESSAGE_PARA$Object must be of type PyCERT_CONTEXT$Object used to construct CRYPT_VERIFY_MESSAGE_PARA structure must be a dict$The certificate context has been closed
                                                                                                                                                                                                    • API String ID: 1444107868-2519308533
                                                                                                                                                                                                    • Opcode ID: 98e464784276a59d2b0b045435c86bcef1f0ce8fdc3807a90172b2d791ad2536
                                                                                                                                                                                                    • Instruction ID: 53b88e6fd8e282a47cc941142eb7b18150101d8dd0023f9340cfd590d1e48fe9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 98e464784276a59d2b0b045435c86bcef1f0ce8fdc3807a90172b2d791ad2536
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CA511C72A48B8291EB50CF28E4903A973A6FF84B84F549132DA8D477B8EF3CD595C744
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB448D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CallEnsureErr_FetchFunction_L_get_ex_dataObjectObject_SizeState_Weakref_
                                                                                                                                                                                                    • String ID: Osiiiy#$read$write
                                                                                                                                                                                                    • API String ID: 671906545-708132800
                                                                                                                                                                                                    • Opcode ID: 645fcf07f5da7349b45dc87f92dfc1d0d7fbb6662d1d95c3aa2e310f901dfa8a
                                                                                                                                                                                                    • Instruction ID: 293499d28c8c4aa26c3dd0dc6dfdec1a6bac599dc4ff4494de443324abaadeab
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 645fcf07f5da7349b45dc87f92dfc1d0d7fbb6662d1d95c3aa2e310f901dfa8a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 09417FB2A08B8586EB788F26A85477877A4FB89B90F044135CADE03764DF3CE551CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5A20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 62COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_HandleProcess$AffinityArg_BuildCallDeallocErrorFromFunctionLastMaskObjectObject_OpenParseTupleValueWindows
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 1951706264-2746090705
                                                                                                                                                                                                    • Opcode ID: c507c77cf1481a22a3872777360ae953a319c7ce717c9610ce264108062b863a
                                                                                                                                                                                                    • Instruction ID: a332393661cad84de0fa329fde831077a61868f539b038312632d8472986bb45
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c507c77cf1481a22a3872777360ae953a319c7ce717c9610ce264108062b863a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C2218120B0CA4382FBD0DB2AF89117DA3A1FF88BC5F844435DA4E4E6B5EE2CE4458700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5CB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Handle$CloseErr_Process$Arg_BuildCallCountDeallocErrorFromFunctionLastObjectObject_OpenParseTupleValueWindows
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 2606922913-2746090705
                                                                                                                                                                                                    • Opcode ID: 7346733c1f7f39a38cd5edfc26ac4fdea36531cf840472a075efbf11d0f9e3b6
                                                                                                                                                                                                    • Instruction ID: 05ba57845b8db674b468ab00974fb9fe441a235f2fb9b7ebccaba6c59224a959
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7346733c1f7f39a38cd5edfc26ac4fdea36531cf840472a075efbf11d0f9e3b6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D9216F20B1C64782FBD4DB26F8951BD63A1FF88BC1F549035DA4E4E675EE2CE8868700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5560 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_Handle$Arg_BuildCallClassDeallocErrorFromFunctionLastObjectObject_OpenParsePriorityProcessTupleValueWindows
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 1753720984-2746090705
                                                                                                                                                                                                    • Opcode ID: e75af5cd8d6276050155a0881f640a595501f42b5400acb48bcb67b9224f08f4
                                                                                                                                                                                                    • Instruction ID: d6a815cb670a5d08030753845cef85d6e0cbd8d280de49425418695ab5d44dc9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e75af5cd8d6276050155a0881f640a595501f42b5400acb48bcb67b9224f08f4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 62215E61B1CA4282FBD49B26F99517D23A1EF98BC5F584035D90E8E6B9EE2CF8458300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB45D0C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 59threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocEval_Thread$Err_FormatSave$ArgsCallObject_RestoreStringUnicode_memcpy
                                                                                                                                                                                                    • String ID: password callback must return a string$password cannot be longer than %d bytes
                                                                                                                                                                                                    • API String ID: 1551476282-1265974473
                                                                                                                                                                                                    • Opcode ID: e73406d9d3b4ad4fb42e875b4519483562846c9b8040fd92d13e9b138ea40bf1
                                                                                                                                                                                                    • Instruction ID: 92fd8a4ee0e3b851e13ff575235f2b8331e587fabe66b822d2cf757b6e9989f4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e73406d9d3b4ad4fb42e875b4519483562846c9b8040fd92d13e9b138ea40bf1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6C211BB5A09F4282EB74AF21E55467833A4EF44B94F044531DADE16AB4CF3CE855CB80
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48754 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 48COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_ArgumentErr_SizeStringUnicode_
                                                                                                                                                                                                    • String ID: No cipher can be selected.$argument$embedded null character$set_ciphers$str
                                                                                                                                                                                                    • API String ID: 4155279725-2765033273
                                                                                                                                                                                                    • Opcode ID: 65d6533581b9c8271e38175ebff8b6600ac832ff9208d34529170bb33971c6e2
                                                                                                                                                                                                    • Instruction ID: b9c0a9bcc5b306d66961df5b39ee67b00003fd2a9b3eb6d7d94e0dd82f01e5a3
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 65d6533581b9c8271e38175ebff8b6600ac832ff9208d34529170bb33971c6e2
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5F216DA1B08B4691EB65DF25E8A01793360FF84B94F545231EAAE436B4DF6CE589CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE132411D0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 349153199-0
                                                                                                                                                                                                    • Opcode ID: 49741281be2100ec61cea02429068dcdc2aa4a812f9568a561c19d79723e8765
                                                                                                                                                                                                    • Instruction ID: ef92c3162f10b87dce02019b0209014eb33d0ae4efb982a0839be4182524665c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 49741281be2100ec61cea02429068dcdc2aa4a812f9568a561c19d79723e8765
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 15815D21F08E43CEFA54BB27A4412B93690AFE57A0F6441B5DA4D676B6EF3CF845C600
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CFA1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1906351414.00007FFE0CFA1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FFE0CFA0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906304405.00007FFE0CFA0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906396362.00007FFE0CFA6000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906458473.00007FFE0CFAB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cfa0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 349153199-0
                                                                                                                                                                                                    • Opcode ID: 474c6b7a685372b53d5ee10a3ee998af2d98c0b67a4930f1a88a30a85650b8b9
                                                                                                                                                                                                    • Instruction ID: 1f22a78a04983a4d0c496cfe7d0aeb902b0070be8e9676a0688d7cf83e938e83
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 474c6b7a685372b53d5ee10a3ee998af2d98c0b67a4930f1a88a30a85650b8b9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4981A0E1E8C643C6FA509B6E944127DE6E4AF85B80F1EE035D90D877B6DE3CE4058702
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4284C Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 349153199-0
                                                                                                                                                                                                    • Opcode ID: 8bc07dac1d2a15841653c24e65cbf90d53687740eca8f36c6e0f4d9ec23f2963
                                                                                                                                                                                                    • Instruction ID: a80492468a3f2d5eb26a2c94c80e519bdc0404652596a683b677cf1859ab6b68
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8bc07dac1d2a15841653c24e65cbf90d53687740eca8f36c6e0f4d9ec23f2963
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 89819DA1E1C74386FA74AF6594412B966A0EF85784F548435FECC873B6DE3CE942AF00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014CA1CC Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 349153199-0
                                                                                                                                                                                                    • Opcode ID: 06333a9d7acbe63338eaf6161784d371345104cbd4f275a22e4b88fd8f894c0b
                                                                                                                                                                                                    • Instruction ID: 63fa9bf4b760ac40f85e15ba0ed4964ef6fc156a096df89485e9f366b61ca2a9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 06333a9d7acbe63338eaf6161784d371345104cbd4f275a22e4b88fd8f894c0b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2C81C421F0C64F86FBD0AB65A8452B96290AF95784F748435EA4D4F7B6FF3CE8468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB21030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908816347.00007FFE0EB21000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFE0EB20000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908712620.00007FFE0EB20000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908843001.00007FFE0EB24000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908867951.00007FFE0EB25000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908898664.00007FFE0EB26000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb20000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 349153199-0
                                                                                                                                                                                                    • Opcode ID: 4a4326d08ce927c1f365e63b7101b1e5be19474ae05a0e5b91d0bd5173d7ba57
                                                                                                                                                                                                    • Instruction ID: 1b74dc937fcc492c9ab40d4cd415e7f077a9392eb6d7d3a608b7a0db4a728828
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4a4326d08ce927c1f365e63b7101b1e5be19474ae05a0e5b91d0bd5173d7ba57
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 79819061E0E24746FA709F6994412B92691AFB5781F44813DDACC877B6DE3CEC028F01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB42274 Relevance: 16.6, APIs: 11, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$FromModuleSpecTypeType_$State
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1138651315-0
                                                                                                                                                                                                    • Opcode ID: 47cdc940ff4b91a51c86818dd6ced2d78f07b15e551b4ece380ee1e2cec1c294
                                                                                                                                                                                                    • Instruction ID: 49497aea0e5228b763ec15d795f21c70e8c5dfafe166f5719eda23b3fe707392
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 47cdc940ff4b91a51c86818dd6ced2d78f07b15e551b4ece380ee1e2cec1c294
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7831DAA5B1AB4392EF749F26E95013923E0FF49B84B045531DE8E47B74EF3CE4648A50
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB41350 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 88COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_KeywordsObject_SizeTrueUnicode_Unpack
                                                                                                                                                                                                    • String ID: argument 'txt'$embedded null character$str$txt2obj
                                                                                                                                                                                                    • API String ID: 3371007025-2001486153
                                                                                                                                                                                                    • Opcode ID: 959f5737da16641b00553c8e7d233da7cdfdf94c9ae612db7a25b7a40e44e655
                                                                                                                                                                                                    • Instruction ID: de3f79a2a38a21ff029c5bc2a1de5ee9ae555e2527f06e7f7be17b8437cd34e0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 959f5737da16641b00553c8e7d233da7cdfdf94c9ae612db7a25b7a40e44e655
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 96314CA2A0DB8695EA709F15E8502B963A0FB84B94F584131DADE477B4DF7CE489CF00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48C34 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 73COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_$ArgumentErr_KeywordsL_get_finishedL_session_reusedSizeStringUnicode_Unpackstrcmp
                                                                                                                                                                                                    • String ID: argument 'cb_type'$embedded null character$get_channel_binding$str$tls-unique
                                                                                                                                                                                                    • API String ID: 2734880604-851902044
                                                                                                                                                                                                    • Opcode ID: 94dd0d709bdb47462423941eefa20115fbe08b78c14f791ca6a1e135fd718c62
                                                                                                                                                                                                    • Instruction ID: 9f7ef519f65c4d621bb0df2e5f3226e1e0fc6e32ff3c9463d63bbdbad9fa928d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 94dd0d709bdb47462423941eefa20115fbe08b78c14f791ca6a1e135fd718c62
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D0319AA2B0AB8295EA659F15E4806B827A0FF44BD4F544136EE9E177B4DF3CE845CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5640 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_Handle$Arg_CallClassDeallocErrorFromFunctionLastObjectObject_OpenParsePriorityProcessTupleWindows
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 4056584219-2746090705
                                                                                                                                                                                                    • Opcode ID: 05f1b297cd338290a46046aa4302f602862c1c7fbbd962f74fc496c0395f1610
                                                                                                                                                                                                    • Instruction ID: dc49906e53db74aceafc03fc0a9f0d578f151326c71d69c414574c6165adb9c5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 05f1b297cd338290a46046aa4302f602862c1c7fbbd962f74fc496c0395f1610
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 36210B21B1CA0682FBD4DB26F89517963A1EF88BC5F445035DA5E4E7B5EE3CE8858700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5B10 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CloseErr_HandleProcess$AffinityArg_CallDeallocErrorFromFunctionLastMaskObjectObject_OpenParseTupleWindows
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 3581221727-2746090705
                                                                                                                                                                                                    • Opcode ID: 1627bd8fbb88020e3ef4271609fca60b3eee16074623bc01e6089d0d9fb41fa1
                                                                                                                                                                                                    • Instruction ID: c30706f1970342270b88760ded0ec1219a829b8929a209795171e7d980e4e1b5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1627bd8fbb88020e3ef4271609fca60b3eee16074623bc01e6089d0d9fb41fa1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 73213821B1CA4682FBD49B26F88517963A1EF98BC5F445035DA5E4E7B5EE3CE4848B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46BF0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_ModuleModule_StateType_$CheckErr_KeywordsLong_OccurredPositional
                                                                                                                                                                                                    • String ID: _SSLContext
                                                                                                                                                                                                    • API String ID: 2062694701-1468230856
                                                                                                                                                                                                    • Opcode ID: e1371deacfaaebdc9b38f4790c519c9be6c75b59ec45b2de1b9275b47040743b
                                                                                                                                                                                                    • Instruction ID: cc1f60446a71125f2cf6db572b95dfe3f4f56fc1a98304f87fd82a68fc3b477d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e1371deacfaaebdc9b38f4790c519c9be6c75b59ec45b2de1b9275b47040743b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 75214FB5B09B0281EB709F22F84427963A1EF45FD0F584435DA9E87779DE3CE4858B44
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3690 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$AdaptersAddressesMemoryStringmalloc
                                                                                                                                                                                                    • String ID: GetAdaptersAddresses() syscall failed.
                                                                                                                                                                                                    • API String ID: 626373182-4058666537
                                                                                                                                                                                                    • Opcode ID: fc02fc1b444a0df5d04b54a4356f0e17b44877713774c7848c951d14cc649c33
                                                                                                                                                                                                    • Instruction ID: eec8605e1b29481f10c5927d30dc9b1189ee59e28d9707bdf52d94fafb8a9e7c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fc02fc1b444a0df5d04b54a4356f0e17b44877713774c7848c951d14cc649c33
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7F214235B18A4283EB94DF22F85556A63A1FB88B85F885035DE4E4BB34DF3DD54ACB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4BEB0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 53COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocErr_StringX_callback_ctrl
                                                                                                                                                                                                    • String ID: not a callable object$sni_callback cannot be set on TLS_CLIENT context
                                                                                                                                                                                                    • API String ID: 3136334877-1539510184
                                                                                                                                                                                                    • Opcode ID: fa678a1aaac4dbb0c21a5538d99ee68003da44d71ab4bae5319ff161659b6391
                                                                                                                                                                                                    • Instruction ID: d3193ab1e96bc34dca0cdc8f2d17f3ec8c65f096bf92e6b980d04d0ac0f0e3ce
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fa678a1aaac4dbb0c21a5538d99ee68003da44d71ab4bae5319ff161659b6391
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3B2109B2A09B02D2EB749F25E89463833A0FF88B98F545531DA9E46A74CF3CE545CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A3867 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49threadencryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Thread$BufferCertCertificateContextErr_Error@@FreeLongLong_Object_OccurredPropertyRestoreSaveU_object@@UnsignedView@@Win_
                                                                                                                                                                                                    • String ID: CertSetCertificateContextProperty
                                                                                                                                                                                                    • API String ID: 2928820455-430795800
                                                                                                                                                                                                    • Opcode ID: 2e63ff136cb6f8eb7a8a1f81ee5c6e66102bebf8cd2b18707f89aa9ccd190eba
                                                                                                                                                                                                    • Instruction ID: 7906bad7d13e6a5a5ae4388f666e8e5562e1f341d1562c58552cde7e70674062
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2e63ff136cb6f8eb7a8a1f81ee5c6e66102bebf8cd2b18707f89aa9ccd190eba
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 23114936A8860286E758DF69A4645BC2366AF49B94B581134DA0E437B4DF3CE845C308
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C2180 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: __acrt_iob_funcfprintf
                                                                                                                                                                                                    • String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
                                                                                                                                                                                                    • API String ID: 3693261709-2941878183
                                                                                                                                                                                                    • Opcode ID: c778e2d208d243d26ea46b1bebc4938fb0e1ec0460e1bb2be868f43f93b6b165
                                                                                                                                                                                                    • Instruction ID: a92819048ea91026c8ada40920e7d38de181687e2e1eab1207336eb2fd1e9eb5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c778e2d208d243d26ea46b1bebc4938fb0e1ec0460e1bb2be868f43f93b6b165
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8111ED74E09A06C1FB85AB56EC912752361FF85BC5F44013AC90E0F3B5DE6CA5468341
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4248C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 31COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: FromInternStringUnicode_$Module_State
                                                                                                                                                                                                    • String ID: library$reason$verify_code$verify_message
                                                                                                                                                                                                    • API String ID: 1970222510-435783180
                                                                                                                                                                                                    • Opcode ID: 1402c12357f8a8a74b39a311a053b1d6e57728cfe69972c1f2afc845fee4e05e
                                                                                                                                                                                                    • Instruction ID: 569cb528dfc0c3182f440a1f9daf0c851e358a72e621fc8ce0b4ed8a7d2b3d4e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1402c12357f8a8a74b39a311a053b1d6e57728cfe69972c1f2afc845fee4e05e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0B01B2B1A0AB0791EE759F20A86467423A0FF18B11F480935D98D893F5FF3CE499DB10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF812D0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: abort$AdjustPointermemcpy
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1935411290-0
                                                                                                                                                                                                    • Opcode ID: aebe0f645d41f27a904c6eb73277e930433f088ab6010ad71299a227848cdf1b
                                                                                                                                                                                                    • Instruction ID: cc901e4e52bb93b2a66828c979b6991ddc63f77cbe6acb65b884c9762a2ecdaf
                                                                                                                                                                                                    • Opcode Fuzzy Hash: aebe0f645d41f27a904c6eb73277e930433f088ab6010ad71299a227848cdf1b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F551BF21A8AA8281FA65CB5D944463C67D4EF45F80F1AC635DE4E06AB4DF2CE44BC302
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF81650 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                                                                                                                                    • String ID: csm$csm$csm
                                                                                                                                                                                                    • API String ID: 211107550-393685449
                                                                                                                                                                                                    • Opcode ID: f08a6160a870c66b307bcb88c6cb9ab2db23fad1165b2d4216fdaba5ff46f998
                                                                                                                                                                                                    • Instruction ID: e701952c9bed9c74ef15fa6c05aa907a996979450f09fbdcf137c8baf8727df0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f08a6160a870c66b307bcb88c6cb9ab2db23fad1165b2d4216fdaba5ff46f998
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 92E1A173948B828AE7209F69D4812AD37E0FF45B58F144235DE8D576B6DF38E48AC702
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE132425C8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
                                                                                                                                                                                                    • String ID: arguments 1-3 must be sequences$too many file descriptors in select()
                                                                                                                                                                                                    • API String ID: 3320488554-3996108163
                                                                                                                                                                                                    • Opcode ID: 05e470237c1967013c16db83c877e5144c843c525c657350500e77854bb128da
                                                                                                                                                                                                    • Instruction ID: 9a7c51d2e132f49338b80585d5d4fde6af8d50b48bedcdd77eb578bfb583ed5d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 05e470237c1967013c16db83c877e5144c843c525c657350500e77854bb128da
                                                                                                                                                                                                    • Instruction Fuzzy Hash: FE415632A09F41CAEA14AF17E94803977A5FBEABB4F004275CA6E537A4DF38E455C300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44208 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_L_is_init_finishedL_set_sessionN_freeString
                                                                                                                                                                                                    • String ID: Cannot set session after handshake.$Cannot set session for server-side SSLSocket.$Session refers to a different SSLContext.$Value is not a SSLSession.
                                                                                                                                                                                                    • API String ID: 2514955158-3160731334
                                                                                                                                                                                                    • Opcode ID: 4fad8aa691907dd192aa8db2c74c7fd083cebb30220e924c775b28bbce20ef84
                                                                                                                                                                                                    • Instruction ID: 97c7e557b5b2217f93695bba8e90bc6763ac6f91a1c5e6658b44557f0f27cbeb
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4fad8aa691907dd192aa8db2c74c7fd083cebb30220e924c775b28bbce20ef84
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4221FDA2A18B5281EB34DF56D48023D63B1FB84B84B544531DAAD87AB4DF7CE4A5CF40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49134 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_ParseSizeTuple_$Buffer_Err_ReleaseStringmemset
                                                                                                                                                                                                    • String ID: _ssl._SSLSocket.read requires 1 to 2 arguments$n:read$nw*:read
                                                                                                                                                                                                    • API String ID: 2062789907-3684439920
                                                                                                                                                                                                    • Opcode ID: e5c8a49dc874aa7bb7d5497f8c318bfa9bca536b92fdaa645dc4d129bf13b899
                                                                                                                                                                                                    • Instruction ID: 7efb971d5ad116da0ce4177e473758e9e68c86aaecc6ee99d863469790ef0f09
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e5c8a49dc874aa7bb7d5497f8c318bfa9bca536b92fdaa645dc4d129bf13b899
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 11212FA2708B4691EB34DF16E8446AA63A1FBC8B80F548136DA9D43774DE3CE949CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A010 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_$ArgumentErr_KeywordsSizeStringUnicode_Unpack
                                                                                                                                                                                                    • String ID: argument 'store_name'$embedded null character$enum_certificates$str
                                                                                                                                                                                                    • API String ID: 2966986319-2881692381
                                                                                                                                                                                                    • Opcode ID: c5313d3cc2dd843cd09a5d35c7defe34951d258d35a66d9f6c41ecc2ff569328
                                                                                                                                                                                                    • Instruction ID: 1ce3bd2cf8ccb6ac48a2c92da2283bb0fbfdaf81b0471de6a89fa70e22a4f5de
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c5313d3cc2dd843cd09a5d35c7defe34951d258d35a66d9f6c41ecc2ff569328
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CA2178A1A49B4381EE628F15E44027963A1FB44B94F544236EA9E037B4EF6DE448CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A35C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_$ArgumentErr_KeywordsSizeStringUnicode_Unpack
                                                                                                                                                                                                    • String ID: argument 'store_name'$embedded null character$enum_crls$str
                                                                                                                                                                                                    • API String ID: 2966986319-2641223161
                                                                                                                                                                                                    • Opcode ID: c7c07cadf9f1106f32e1fbbdb29ffffdfbe69cd321eed40f14786686afd1da75
                                                                                                                                                                                                    • Instruction ID: 9642a21a95373e76a63b3a4b19aaf4f2ede9c2e1304b95704f8eac93e5dd2976
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c7c07cadf9f1106f32e1fbbdb29ffffdfbe69cd321eed40f14786686afd1da75
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 132159A2B49B4685EE608F14E49426963A1FF48B94F944236DA9E437B4FF3CE548CF00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48FD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • SSL_is_init_finished.LIBSSL-3(?,?,00000000,00007FFE0EB48FAE), ref: 00007FFE0EB48FE8
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,00000000,00007FFE0EB48FAE), ref: 00007FFE0EB49003
                                                                                                                                                                                                    • SSL_get1_peer_certificate.LIBSSL-3(?,?,00000000,00007FFE0EB48FAE), ref: 00007FFE0EB49011
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_L_get1_peer_certificateL_is_init_finishedString
                                                                                                                                                                                                    • String ID: handshake not done yet
                                                                                                                                                                                                    • API String ID: 1333720006-2620869922
                                                                                                                                                                                                    • Opcode ID: 1a7a3d864b69d84d655e412ecb51a5752bf9d9009876d09ee1b02abede4ebb73
                                                                                                                                                                                                    • Instruction ID: da9628025d3ab7bc56a37214cbd461f7ff5bb43a8f0bbd92acfa8cfeb7339156
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1a7a3d864b69d84d655e412ecb51a5752bf9d9009876d09ee1b02abede4ebb73
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9621F9A1B08B5381EA219F16E95413A63A0FFD8FD4B144131DECE87775DF2DE8928B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A3844 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51threadencryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Object_ThreadU_object@@$BufferCertCertificateContextError@@FreePropertyRestoreSaveView@@Win_
                                                                                                                                                                                                    • String ID: CertSetCertificateContextProperty
                                                                                                                                                                                                    • API String ID: 1244965724-430795800
                                                                                                                                                                                                    • Opcode ID: 9e134f5eb02bdcca9df14db372a070e58457e34017cec55f7ee906a1eaa94e11
                                                                                                                                                                                                    • Instruction ID: 51da5fa35be65214320fe0407cec50ea8e1d8acac0471fdcf678a66ff237a835
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9e134f5eb02bdcca9df14db372a070e58457e34017cec55f7ee906a1eaa94e11
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C0113A36B886528AE754DF69E8645BC2366EF48B84B481035EE0F537B4DF38E945C708
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A388D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51threadencryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BufferEval_ThreadView@@$?init@CertCertificateContextError@@FreeObject_PropertyRestoreSaveU_object@@U_object@@_Win_
                                                                                                                                                                                                    • String ID: CertSetCertificateContextProperty
                                                                                                                                                                                                    • API String ID: 1617547322-430795800
                                                                                                                                                                                                    • Opcode ID: f27181a7de84c328d29fba2eb0f6b290ac4dc65668c650c412085dbecc3828c4
                                                                                                                                                                                                    • Instruction ID: b46e373c91e390f0233823fc8433479e8981be93e57327c2a8061997cf248b42
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f27181a7de84c328d29fba2eb0f6b290ac4dc65668c650c412085dbecc3828c4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 45114C36B886428AE754DF69E8A45BC2366EF44B84B081035DF0E53BB8DF38E945C708
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3215 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$unmounted
                                                                                                                                                                                                    • API String ID: 1595588724-3738632989
                                                                                                                                                                                                    • Opcode ID: 3d38fa3c60011b3d2ff5720ae2175fee70185e9389ff44ded707c747f554459a
                                                                                                                                                                                                    • Instruction ID: 243a09a950b60596e1536652dc3f7edb6fba0e7ff0042d3b38290d44db0621c1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3d38fa3c60011b3d2ff5720ae2175fee70185e9389ff44ded707c747f554459a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: EB114F76A0DA8286EBA0CF21E8143B963A1FB89B98F448035D94E4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C320C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$unknown
                                                                                                                                                                                                    • API String ID: 1595588724-3196183135
                                                                                                                                                                                                    • Opcode ID: c3d557c37ebec8720dcdbd509fcf4641481417501de4c1fb6c4ec45ad15c4525
                                                                                                                                                                                                    • Instruction ID: 23ffed5ad2dc3d77b4a4d249fe06b94af17abf452c2c20aa7baa72efa1ad6544
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c3d557c37ebec8720dcdbd509fcf4641481417501de4c1fb6c4ec45ad15c4525
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C0115172A0DA8286EBA0CF21E8143B963A1FB89B98F448035DD4E4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3203 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$removable
                                                                                                                                                                                                    • API String ID: 1595588724-1181830169
                                                                                                                                                                                                    • Opcode ID: 99fd098ea35aa02d65fa872fdecb6c0df98beb6b8163ad289835d3f5805f9259
                                                                                                                                                                                                    • Instruction ID: 06113e89f01bd2d1f5fd439709ad4208ff7612dc6f6f74b2d8bda5add53a5044
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 99fd098ea35aa02d65fa872fdecb6c0df98beb6b8163ad289835d3f5805f9259
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C7115472A0DA8686EBA0CF21E4143B963A1FB85B98F448035DD4D4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5F02 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)$xwc
                                                                                                                                                                                                    • API String ID: 1097362947-1454042600
                                                                                                                                                                                                    • Opcode ID: 8199e507e03b67da4e304b2b9c180a68cf96e24ccead2776df7fcf51dd0375f0
                                                                                                                                                                                                    • Instruction ID: 92d01f12098512c757b0a4d439e83c7bf2b58b66136e88cbbbd236bd9f92f941
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8199e507e03b67da4e304b2b9c180a68cf96e24ccead2776df7fcf51dd0375f0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 01110A26B0AA8385EBA49B12A46537D6360FF95BD9F440032DE4E5F774DF3CE5468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3227 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$ramdisk
                                                                                                                                                                                                    • API String ID: 1595588724-2047227641
                                                                                                                                                                                                    • Opcode ID: fbee4117e6008f62086a4200879108072a597a1e83331de524ecdba9f3a55db7
                                                                                                                                                                                                    • Instruction ID: 2e26dc7620c39512e05d33257f31b2e37534a1b247d9f7203d37445b18e42ffb
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fbee4117e6008f62086a4200879108072a597a1e83331de524ecdba9f3a55db7
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 42115172A0DA8286EBA0CF21E8143B963A1FB89B98F448035DD4E4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C321E Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$remote
                                                                                                                                                                                                    • API String ID: 1595588724-2439754154
                                                                                                                                                                                                    • Opcode ID: bd9fec3357defba29d18cb7e941318e2e15bd881230ae49fba78a016eecef9f8
                                                                                                                                                                                                    • Instruction ID: 566bfa50b79802f0df2b31a41181f399b28068af20caa48031f032e464cf66c9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: bd9fec3357defba29d18cb7e941318e2e15bd881230ae49fba78a016eecef9f8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 94115176A0DA8286EBA0CF21E8143B963A1FB89B98F448035DD4E4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5EF9 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)$xrw
                                                                                                                                                                                                    • API String ID: 1097362947-822595024
                                                                                                                                                                                                    • Opcode ID: edfa70bdc96bfdf41d6426709f7168af8450979f8088e4f15d83172a9b0353f9
                                                                                                                                                                                                    • Instruction ID: 738f5957588b48faed2d40cafd7eb061a89eed363cf1df7b448138f9fda530d6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: edfa70bdc96bfdf41d6426709f7168af8450979f8088e4f15d83172a9b0353f9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0C110A26B0AA8385EBA49B12A46537D6360FF95BD9F440032DE4E5F774DF3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C31FA Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$cdrom
                                                                                                                                                                                                    • API String ID: 1595588724-2526730455
                                                                                                                                                                                                    • Opcode ID: 009e84a3dd07757d79ac9de226ba09c2149430d14eadb5d08edcb96af62f5423
                                                                                                                                                                                                    • Instruction ID: 6c9fe7d062bfd5ecdf974386f156529a327e78015106b8b666a76d9c815ff3c0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 009e84a3dd07757d79ac9de226ba09c2149430d14eadb5d08edcb96af62f5423
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D4115172A0DA8286EBA0CF21E8143B963A5FB89B99F448035DD4E4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C31F1 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$ErrorMode$AppendBuildList_Valuestrcat_sstrchr
                                                                                                                                                                                                    • String ID: (ssssIi)$fixed
                                                                                                                                                                                                    • API String ID: 1595588724-582244994
                                                                                                                                                                                                    • Opcode ID: 38001741549e5c0a1df1c9b2ae76a87ab216c1662df03cdf97df56cc95b04d22
                                                                                                                                                                                                    • Instruction ID: 291fc93c91a721f0974d773cfaa449e315a06750dca30de670c2cef6b8bb211e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 38001741549e5c0a1df1c9b2ae76a87ab216c1662df03cdf97df56cc95b04d22
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5F115172A0DA8286EBA0CF21E8143B963A1FB89B99F448035DD4E4B774DF3CE549C700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48D48 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Bytes_Err_FormatFromL_get_finishedL_get_peer_finishedL_session_reusedSizeStringstrcmp
                                                                                                                                                                                                    • String ID: '%s' channel binding type not implemented$tls-unique
                                                                                                                                                                                                    • API String ID: 797867279-2744131590
                                                                                                                                                                                                    • Opcode ID: 8d50ed1c02684afb4dd6c145758dc6ec0c738ed35f1926156c9e46e9169a662b
                                                                                                                                                                                                    • Instruction ID: 06de10b96b09cc7c17abbab8167c2bc9b705df0af6dc52c1faa4a9a965298fce
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8d50ed1c02684afb4dd6c145758dc6ec0c738ed35f1926156c9e46e9169a662b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 62114CA2B0DB8282FB749F25F85037923A0FF98B80F444439DA8E87674DF2CE4448B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46CD4 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Buffer_$Arg_ArgumentBufferContiguousObject_Releasememset
                                                                                                                                                                                                    • String ID: _set_alpn_protocols$argument$contiguous buffer
                                                                                                                                                                                                    • API String ID: 365628853-4024966138
                                                                                                                                                                                                    • Opcode ID: 0f20f3038e1dfd18c903f0e0226122674f88f47fcf5af29b7bff51690fe08e78
                                                                                                                                                                                                    • Instruction ID: 755c3b6e829d6ff0ae9e4ef52fe36070057e89672c9d45f70de973533c0aeb56
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0f20f3038e1dfd18c903f0e0226122674f88f47fcf5af29b7bff51690fe08e78
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6A1163A6B08B86C1EB30DF16E4442B963A0FB89B84F548135DA9D57678DF3CD945CF40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49A04 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Buffer_$Arg_ArgumentBufferContiguousObject_Releasememset
                                                                                                                                                                                                    • String ID: argument$contiguous buffer$write
                                                                                                                                                                                                    • API String ID: 365628853-2056178395
                                                                                                                                                                                                    • Opcode ID: c63dbd9088118895080ee53a787eca1c41674bc9deb07bb5a6f46df85d7abd23
                                                                                                                                                                                                    • Instruction ID: a127f76144ad666674aef3e9ae7bfe5d7034c22498928effafb183da1e98027a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c63dbd9088118895080ee53a787eca1c41674bc9deb07bb5a6f46df85d7abd23
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8E112EA2B08B46D2EB20DF25E8542B963A0FBC8B84F948131DA8D53674DF3CD949CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46774 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Buffer_$Arg_ArgumentBufferContiguousObject_Releasememset
                                                                                                                                                                                                    • String ID: argument$contiguous buffer$write
                                                                                                                                                                                                    • API String ID: 365628853-2056178395
                                                                                                                                                                                                    • Opcode ID: 4fa13b93964b0a400ccb6f7eb6bc5b8e072b19959a78b12e777e6ffd1833d97b
                                                                                                                                                                                                    • Instruction ID: aaef279c99039b3064484a840df7183e49277b36a2940b50d6f7bfe4e789eb04
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4fa13b93964b0a400ccb6f7eb6bc5b8e072b19959a78b12e777e6ffd1833d97b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2B1186A6B08B46D1EB34DF15E4442B963A0FB89F84F948135DA8D53674DF3CE649CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46868 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyErr_Format.PYTHON311(?,?,?,?,00000000,00007FFE0EB467F6), ref: 00007FFE0EB46890
                                                                                                                                                                                                    • PyType_GetModule.PYTHON311(?,?,?,?,00000000,00007FFE0EB467F6), ref: 00007FFE0EB468A8
                                                                                                                                                                                                    • PyModule_GetState.PYTHON311(?,?,?,?,00000000,00007FFE0EB467F6), ref: 00007FFE0EB468B6
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,?,?,00000000,00007FFE0EB467F6), ref: 00007FFE0EB468C7
                                                                                                                                                                                                    • BIO_write.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE0EB467F6), ref: 00007FFE0EB468DA
                                                                                                                                                                                                    • PyType_GetModuleState.PYTHON311(?,?,?,?,00000000,00007FFE0EB467F6), ref: 00007FFE0EB468E8
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB461AC: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE0EB461C4
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB461AC: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE0EB461F0
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_ModuleStateType_$FormatModule_O_writeR_clear_errorR_peek_last_errorString
                                                                                                                                                                                                    • String ID: cannot write() after write_eof()$string longer than %d bytes
                                                                                                                                                                                                    • API String ID: 11717643-118187971
                                                                                                                                                                                                    • Opcode ID: 26e0b49eb4fc4a18de96d9f17ac9ed0089a07110079fd9548f8d3040c0727ab1
                                                                                                                                                                                                    • Instruction ID: 9cf467f4635296467a617cbeb2add3f7ea7232e96f3c5d49bd83748fe8c5f8d6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 26e0b49eb4fc4a18de96d9f17ac9ed0089a07110079fd9548f8d3040c0727ab1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1B110AA5F19B0682EB659F25D85413823A0FF89B54B104835CA9E876B4EF3CE48ACB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46D84 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_Mem_$FormatFreeMallocMemory
                                                                                                                                                                                                    • String ID: protocols longer than %u bytes
                                                                                                                                                                                                    • API String ID: 2903777688-895981740
                                                                                                                                                                                                    • Opcode ID: 54da326cfaeb0cfc4f49dd19802fcede30d4583fa5cf21b5bb6cedfd4ba75597
                                                                                                                                                                                                    • Instruction ID: 990a4f940eafec88fcd514460bd7241a11ea8ac3d9858047d93f07777556f271
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 54da326cfaeb0cfc4f49dd19802fcede30d4583fa5cf21b5bb6cedfd4ba75597
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7E11E9F5B08B0292EB249F26E84006823B0FB89F94B105536DE9E47778DF38E461CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A9070 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 30COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Size$Bytes_FromString$BuildValue_
                                                                                                                                                                                                    • String ID: CertIssuer$CertSerialNumber$KeyId${s:N, s:N, s:N}
                                                                                                                                                                                                    • API String ID: 2781604664-3203442839
                                                                                                                                                                                                    • Opcode ID: dd284099436d09809f66bca25f393a4917dcd55638179a0eef1fd78708d07dac
                                                                                                                                                                                                    • Instruction ID: 74aefe023329a00e38507ea66de268582d8936fcad821d1586fdc3642ace5627
                                                                                                                                                                                                    • Opcode Fuzzy Hash: dd284099436d09809f66bca25f393a4917dcd55638179a0eef1fd78708d07dac
                                                                                                                                                                                                    • Instruction Fuzzy Hash: F301C876A48B41D2D720CB55F9600AAB375FB88B90B244232DB8E43B38DF3CE596C744
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB495AC Relevance: 13.6, APIs: 9, Instructions: 78COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: L_sk_num$L_get_ciphersL_get_client_ciphersL_sk_findL_sk_valueList_
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1815754784-0
                                                                                                                                                                                                    • Opcode ID: f1bab74b26875bb47516a757262cbb7ccc34864ad093ca3117f5124e2544b684
                                                                                                                                                                                                    • Instruction ID: b4edfcf85d888e10769f7afc40c2c0906123beb47f593e2c5a945ff7d102df21
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f1bab74b26875bb47516a757262cbb7ccc34864ad093ca3117f5124e2544b684
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8A3126A1B09B5385EB259F66A95413A63E0FF89FD5B040435CE8E877B4EE3CE4528B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB475A0 Relevance: 13.6, APIs: 9, Instructions: 68COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: L_sk_num$L_freeL_get_ciphersL_newL_sk_valueList_R_clear_errorR_peek_last_error
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 722909353-0
                                                                                                                                                                                                    • Opcode ID: 1dd064c83511a234d100988b8b1553f9850a5ef2e3115354a982f188fd4ddbdc
                                                                                                                                                                                                    • Instruction ID: 5da04dd4a4dde3e914dff3f504ddaeaefe964b1ee26ebdf6ff74c491fd1df6c9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1dd064c83511a234d100988b8b1553f9850a5ef2e3115354a982f188fd4ddbdc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 88212CA5B09B6686EA249FAAA55413973A1FF85FC0B444036DECE43775EF3CE401CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46E34 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 120COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_$ArgumentErr_KeywordsLong_OccurredSubtypeType_Unpack
                                                                                                                                                                                                    • String ID: _wrap_bio$argument 'incoming'$argument 'outgoing'
                                                                                                                                                                                                    • API String ID: 1983060003-586963342
                                                                                                                                                                                                    • Opcode ID: f255784dd93e23d7db9ff5fbbcbf2e7613116bc8d1e87e563ec7dacf06cbdc71
                                                                                                                                                                                                    • Instruction ID: c26122d3068a7cb1eed1b23c508e9958ca3d2a0a29b9f3ce9e2358dbb3be0d00
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f255784dd93e23d7db9ff5fbbcbf2e7613116bc8d1e87e563ec7dacf06cbdc71
                                                                                                                                                                                                    • Instruction Fuzzy Hash: AC417EA2B09B4292EA74DF02E45066977A4FB49BD4F444436EECD03B68DF3CE459CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF835B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FFE0CF83777,?,?,00000000,00007FFE0CF835A8,?,?,?,?,00007FFE0CF83319), ref: 00007FFE0CF8363D
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FFE0CF83777,?,?,00000000,00007FFE0CF835A8,?,?,?,?,00007FFE0CF83319), ref: 00007FFE0CF8364B
                                                                                                                                                                                                    • wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE0CF83777,?,?,00000000,00007FFE0CF835A8,?,?,?,?,00007FFE0CF83319), ref: 00007FFE0CF83664
                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FFE0CF83777,?,?,00000000,00007FFE0CF835A8,?,?,?,?,00007FFE0CF83319), ref: 00007FFE0CF83676
                                                                                                                                                                                                    • FreeLibrary.KERNEL32(?,?,?,00007FFE0CF83777,?,?,00000000,00007FFE0CF835A8,?,?,?,?,00007FFE0CF83319), ref: 00007FFE0CF836BC
                                                                                                                                                                                                    • GetProcAddress.KERNEL32(?,?,?,00007FFE0CF83777,?,?,00000000,00007FFE0CF835A8,?,?,?,?,00007FFE0CF83319), ref: 00007FFE0CF836C8
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
                                                                                                                                                                                                    • String ID: api-ms-
                                                                                                                                                                                                    • API String ID: 916704608-2084034818
                                                                                                                                                                                                    • Opcode ID: cf5019d4659be4cdeff9ec28b9b2da129224bb91f5b965e621d510b94666e210
                                                                                                                                                                                                    • Instruction ID: 398c0da9fb534032eb44ced3c7ca3d2ec68bc28d971e29bfe3aa267b4bbc286a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: cf5019d4659be4cdeff9ec28b9b2da129224bb91f5b965e621d510b94666e210
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6631A021B5AB4291EE119B0EA800A7523E4BF48FB0F694535DD5E0B3B8EF3CE44D8702
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3338 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_BuildDeviceParseQueryTupleValue__stdio_common_vsprintf_smemsetswprintf_s
                                                                                                                                                                                                    • String ID: %c:$:
                                                                                                                                                                                                    • API String ID: 784832287-4169684950
                                                                                                                                                                                                    • Opcode ID: 31c5c8301c2de3d36a15d6dfab923ae20051fbd1fed2308b5cc12eb6b43828f1
                                                                                                                                                                                                    • Instruction ID: c036ea21717afbb5159ae5829a3a1dda077a9acefb9dba3bebec99f8ef189add
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 31c5c8301c2de3d36a15d6dfab923ae20051fbd1fed2308b5cc12eb6b43828f1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0031B972A1C68345EBA18F65E8513FA77A1FF85784F848036D68D4B6B5EF2CD50ACB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8B40 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56servicethreadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_ServiceThread$Arg_CloseControlHandleParseRestoreSaveTuple
                                                                                                                                                                                                    • String ID: ControlService
                                                                                                                                                                                                    • API String ID: 1908151670-253159669
                                                                                                                                                                                                    • Opcode ID: 0bd50414f625bf8c3a373ff3c6956ce3154c3f3eafcbbe842b93a4c24bc34f3e
                                                                                                                                                                                                    • Instruction ID: f317fbaa64e8f2ea6bb5b7546aa368762439ac9cb4d114e60a8a97419c27f2f6
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0bd50414f625bf8c3a373ff3c6956ce3154c3f3eafcbbe842b93a4c24bc34f3e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 93211F75B0DB4A82EB91DB26E85127A63A5FF89BC4F440031D94D4BB75EF3CE5468B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5ED5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1097362947-341566991
                                                                                                                                                                                                    • Opcode ID: bd46dca3eefb83b19a3cad5f2209f0694ef2c311df6377a1947c372ff81cba2d
                                                                                                                                                                                                    • Instruction ID: f2f62c895c0d9a6f9de924bcf307795786c029330b20c7d5eead71b7fa546b47
                                                                                                                                                                                                    • Opcode Fuzzy Hash: bd46dca3eefb83b19a3cad5f2209f0694ef2c311df6377a1947c372ff81cba2d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B110A26B0AA8385EBA49B12A46537D6360FF95BD9F444032DE4E5F774DF3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5ECC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1097362947-341566991
                                                                                                                                                                                                    • Opcode ID: 4802944766b3e3410c4ee7763bd92ba3f21428baffba4182298b79b6524ec138
                                                                                                                                                                                                    • Instruction ID: ec6a5883230802af1ef35a5a98f2b176b2beff071ca8c9f3bdd5cc1cae7bebb8
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4802944766b3e3410c4ee7763bd92ba3f21428baffba4182298b79b6524ec138
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8F11F826B0AA8685EBA49B12A46537D6360FF95BD9F440032DE4E5F7B4DE3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5EC3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1097362947-341566991
                                                                                                                                                                                                    • Opcode ID: 6ae276da15dd6b0768f8f9178def6a3b67575404069932c5628f4476ec2f3b87
                                                                                                                                                                                                    • Instruction ID: 8853c5e2b855a95cdd4b91d2c9e4d54ea660200a0ef1ec4de8f3c71bdb9ffdcf
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6ae276da15dd6b0768f8f9178def6a3b67575404069932c5628f4476ec2f3b87
                                                                                                                                                                                                    • Instruction Fuzzy Hash: B9110626B0AA8385EBA49B12A46937D6360FF99BD9F444032DE4E5F774DF3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5EF0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1097362947-341566991
                                                                                                                                                                                                    • Opcode ID: 360d9bd8d462961dd12dc4315046726bbe0e437f9d60aaa4629de3bedbc7eef0
                                                                                                                                                                                                    • Instruction ID: 6b5d37d16f9f4228be3ce9a0488a67e726cd181b4f3b9df1df2a503c2238ce60
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 360d9bd8d462961dd12dc4315046726bbe0e437f9d60aaa4629de3bedbc7eef0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 43110A26B0AA8385EBA49B12A46537D6360FF95BD9F444032DE4E5F774DF3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5EE7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1097362947-341566991
                                                                                                                                                                                                    • Opcode ID: b96f1136cafb5c594097d3d3d02fe7540ac1bdb50ca908c58bc22b58da03db86
                                                                                                                                                                                                    • Instruction ID: 015ae171c9410c56e4dd51e86638a25a4846f61bea2070bfef89335893d43e44
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b96f1136cafb5c594097d3d3d02fe7540ac1bdb50ca908c58bc22b58da03db86
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3F11F826B0AA8285EBA49B12A46537D6360FF95BD9F440032DE4E5F774DE3CE4468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C5EDE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$CloseHandle$AppendBuildList_QueryValueVirtual
                                                                                                                                                                                                    • String ID: (KsOI)
                                                                                                                                                                                                    • API String ID: 1097362947-341566991
                                                                                                                                                                                                    • Opcode ID: ed9b50c8e464a2a48eb0f50c6a33a7f016c0c0e4932dea92ba5103c468c20889
                                                                                                                                                                                                    • Instruction ID: 79f2e18ed22f2c4ee0641087e0bbb927a0a333ace7d63fdc14601b10c4d80089
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ed9b50c8e464a2a48eb0f50c6a33a7f016c0c0e4932dea92ba5103c468c20889
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 54113A22B0AA8381EBA48B12A46437D6360FF94BD9F440032DE4E5F774DF3CE0468700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A9C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: E_print_exErr_O_freeO_newO_s_memStringX509_
                                                                                                                                                                                                    • String ID: failed to allocate BIO$strict
                                                                                                                                                                                                    • API String ID: 220268057-2811890329
                                                                                                                                                                                                    • Opcode ID: faf922226ecea867cceba12aa025300dd94e336be2786a4f7331e8c570b3d635
                                                                                                                                                                                                    • Instruction ID: 4f9344606803bce620a34578d878aa7185075ddb599bbe6899d72abcd9550a65
                                                                                                                                                                                                    • Opcode Fuzzy Hash: faf922226ecea867cceba12aa025300dd94e336be2786a4f7331e8c570b3d635
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 66111FA5B18B5281EA209F16B904169A3A0FF89FC4F449035DD9D47B35EE7CE4458F44
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB414C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB414EA
                                                                                                                                                                                                    • OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB414FC
                                                                                                                                                                                                    • OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB41507
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB41558: OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFE0EB4159D
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB41558: PyUnicode_FromStringAndSize.PYTHON311 ref: 00007FFE0EB415C3
                                                                                                                                                                                                    • _Py_BuildValue_SizeT.PYTHON311(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB41535
                                                                                                                                                                                                    • PyErr_Format.PYTHON311(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB43633
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Size$BuildErr_FormatFromJ_nid2lnJ_nid2snJ_obj2nidJ_obj2txtStringUnicode_Value_
                                                                                                                                                                                                    • String ID: Unknown object$issN
                                                                                                                                                                                                    • API String ID: 1805764990-847857892
                                                                                                                                                                                                    • Opcode ID: 36dc22c37b80143fa571bc994d527e926e6cf506b95b83dc09d1e569a5f0b79d
                                                                                                                                                                                                    • Instruction ID: c92d625afc0b1e93a76245c09a9a0f09144373b5317744ff59da140643f66d98
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 36dc22c37b80143fa571bc994d527e926e6cf506b95b83dc09d1e569a5f0b79d
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D2115BA5B08B5282EA209F26F844069A7A0FB88FD0F494135DE8D87B34DF3CE445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4A83C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyErr_SetString.PYTHON311(?,?,00000000,00007FFE0EB4A825), ref: 00007FFE0EB4A865
                                                                                                                                                                                                    • OBJ_nid2obj.LIBCRYPTO-3(?,?,00000000,00007FFE0EB4A825), ref: 00007FFE0EB4A871
                                                                                                                                                                                                    • PyErr_Format.PYTHON311(?,?,00000000,00007FFE0EB4A825), ref: 00007FFE0EB4A893
                                                                                                                                                                                                    • PyModule_GetState.PYTHON311(?,?,00000000,00007FFE0EB4A825), ref: 00007FFE0EB4A89E
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB414EA
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB414FC
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB41507
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: _Py_BuildValue_SizeT.PYTHON311(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB41535
                                                                                                                                                                                                    • ASN1_OBJECT_free.LIBCRYPTO-3(?,?,00000000,00007FFE0EB4A825), ref: 00007FFE0EB4A8B5
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_$BuildFormatJ_nid2lnJ_nid2objJ_nid2snJ_obj2nidModule_SizeStateStringT_freeValue_
                                                                                                                                                                                                    • String ID: NID must be positive.$unknown NID %i
                                                                                                                                                                                                    • API String ID: 278606715-2656559464
                                                                                                                                                                                                    • Opcode ID: 46be0302ecffe7bfb3ff6baf73789ef088bb09e6bdfa45e7028a00e3d4db01ed
                                                                                                                                                                                                    • Instruction ID: 4275added8d1637987cad90494d133a93e7f149e9f7a480e980a568828fafa67
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 46be0302ecffe7bfb3ff6baf73789ef088bb09e6bdfa45e7028a00e3d4db01ed
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5901E9A1F0CB4781FB259F2AE89403963A1EF88FD4F444035DA9E47B75EE2CE4468B41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46590 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_O_ctrlO_freeO_newO_s_memO_set_flagsString
                                                                                                                                                                                                    • String ID: failed to allocate BIO
                                                                                                                                                                                                    • API String ID: 68942223-3472608418
                                                                                                                                                                                                    • Opcode ID: 8b779c9eb802de0de17df004077da30b3db4fa585093d4e23d18d1c054d83fa0
                                                                                                                                                                                                    • Instruction ID: 391bcb047ebc94086377d8bb464f94443539efb76e4683ed0c6ec03bcb070ee9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8b779c9eb802de0de17df004077da30b3db4fa585093d4e23d18d1c054d83fa0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 33017CA1B08B0382EB289F62F91423963A1FF89F88F549134C99E07774EF3CE4448B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4AEF0 Relevance: 12.1, APIs: 8, Instructions: 54COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: From$StringUnicode_$DeallocLongLong_R_get_bitsR_get_nameR_get_versionTuple_
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 4201023408-0
                                                                                                                                                                                                    • Opcode ID: af91989f8f6ef995968b4aac6cd9fd6eb7c3ad7b281da09ffa923e0ef52d3d59
                                                                                                                                                                                                    • Instruction ID: 516bd4e7a3515a7d378f3c67c5e382dd4c2e5100d4f14aba064cbfa45527d1d1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: af91989f8f6ef995968b4aac6cd9fd6eb7c3ad7b281da09ffa923e0ef52d3d59
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 11210DE1B0DB0281EE799F25A9A423823A0EF48F84F084538DACE47774EE3CA445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB43E6C Relevance: 12.0, APIs: 8, Instructions: 44COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Object_$L_freeTrack
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 970091570-0
                                                                                                                                                                                                    • Opcode ID: b0e599ac66df4f0e6e0c2d6137c060a2e9bd98878a92bf8c7772b62ccb78a9c6
                                                                                                                                                                                                    • Instruction ID: f93ace4ba460febf33e7a37a50ff11529f664ab80982960b266794b1a54fe088
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b0e599ac66df4f0e6e0c2d6137c060a2e9bd98878a92bf8c7772b62ccb78a9c6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D711D6B6E4EB02C1FF799F75A95413823E4EF65F64B184534CA8E02A64CF2DE4848B51
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB21D40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908816347.00007FFE0EB21000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFE0EB20000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908712620.00007FFE0EB20000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908843001.00007FFE0EB24000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908867951.00007FFE0EB25000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908898664.00007FFE0EB26000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb20000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _wassert$memcpy
                                                                                                                                                                                                    • String ID: hs->curlen < BLOCK_SIZE$src/SHA1.c
                                                                                                                                                                                                    • API String ID: 4292997394-330188172
                                                                                                                                                                                                    • Opcode ID: 37e1da89a34f1fddfd52276c87dcf26d1b8ef69f47a37c17d1edcbdd39df0853
                                                                                                                                                                                                    • Instruction ID: dcdb1d7bc3df87f563574cd1c4799c2d256cbb3d76155e428f7933329b1a553b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 37e1da89a34f1fddfd52276c87dcf26d1b8ef69f47a37c17d1edcbdd39df0853
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3091A322F19A8586FB11CF28D5043FD6361FBA8384F449235DF8C16A6ADF38E985CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB470AC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_$ArgumentErr_KeywordsLong_OccurredUnpack
                                                                                                                                                                                                    • String ID: _wrap_socket$argument 'sock'
                                                                                                                                                                                                    • API String ID: 3416574803-3343203394
                                                                                                                                                                                                    • Opcode ID: b47a08dbae83d301334e4858541c1fb8619808e5d42e22fc38b9b66c70f5e4e7
                                                                                                                                                                                                    • Instruction ID: 93a76b7b044912a00b638208b3f8e757f1e38e19e96a87556e185cdb1170cc7c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b47a08dbae83d301334e4858541c1fb8619808e5d42e22fc38b9b66c70f5e4e7
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 43419FA2B09BA292EA71DF12E84066977A0FF49BD4F444436DE8C47764DF3CE555CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB41558 Relevance: 10.6, APIs: 7, Instructions: 89COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: J_obj2txt$FromMallocMem_SizeStringUnicode_
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2822617359-0
                                                                                                                                                                                                    • Opcode ID: 8dd72aa9958327135ff0b6ab2159f3875ac77918b4b4a71c28d39d14b7d9f3cc
                                                                                                                                                                                                    • Instruction ID: 7ea2317962031db57527cf5d23c7c60e9d1b8c6f66f721e8963727c54c90b247
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8dd72aa9958327135ff0b6ab2159f3875ac77918b4b4a71c28d39d14b7d9f3cc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 35316DA1B1DB9285FB718F66A8147BA6290EF89B84F445431DE8E877B5DE3CE0458F00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB43910 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_N_get_id$ArgumentCallInternalmemcmp
                                                                                                                                                                                                    • String ID: D:\a\1\s\Modules\_ssl.c
                                                                                                                                                                                                    • API String ID: 2709062062-132925792
                                                                                                                                                                                                    • Opcode ID: c2a8348eb9e6693873ab47f985ca8bfd22968f8ee8dfdbdba6370d880fe16349
                                                                                                                                                                                                    • Instruction ID: 7a388c1cd2b3b8c72b5eaae5c046f769a51fdd2f55aa18d3239b0e90fc948886
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c2a8348eb9e6693873ab47f985ca8bfd22968f8ee8dfdbdba6370d880fe16349
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 103129B1B0DB4291EA788F19D59613962E0FF45B84F584436DADF47BB4DE2EE841CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE13241090 Relevance: 10.6, APIs: 7, Instructions: 62COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocModule_State
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1903735390-0
                                                                                                                                                                                                    • Opcode ID: a7a767094c4d1de27d1ae5cfedc4f2a8987a46609b88e723d83c121dba346a55
                                                                                                                                                                                                    • Instruction ID: 125dfc9cc43934b6b16fedcadfaf351fd7de81fc03211e50e42b728e279b31d2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a7a767094c4d1de27d1ae5cfedc4f2a8987a46609b88e723d83c121dba346a55
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2A21EA31E09E42C9FB69AF73985833832A4AFA5F69F2450B4CA0E651A4CF6DA554C300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB466B4 Relevance: 10.6, APIs: 7, Instructions: 56COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Bytes_O_ctrl_pending$DeallocFromModuleO_readResizeSizeStateStringType_
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3878297189-0
                                                                                                                                                                                                    • Opcode ID: 5380689208eaa865dbf1d9cb8028f65d17c2aaad1cae643070cb98648f60328e
                                                                                                                                                                                                    • Instruction ID: 4b39ad9780441041ace2bcc77eadf288e0de75a56d8bcfe982a287d9988d62a2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5380689208eaa865dbf1d9cb8028f65d17c2aaad1cae643070cb98648f60328e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0D217FB5B08B4282EF348F65E98003963A1FF8AB94B144535DF9E82779EF7DE4448B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A7050 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BufferView@@$?init@Arg_Err_Keywords_ParseSizeStringTupleU_object@@_
                                                                                                                                                                                                    • String ID: Object used to construct a CRYPT_BIT_BLOB must be a dict$Ok:CRYPT_BIT_BLOB
                                                                                                                                                                                                    • API String ID: 1863331557-1057895879
                                                                                                                                                                                                    • Opcode ID: 9bd7dbeddbf4d01ef53bd7e298c0cce26d155d1eb7edca795c507e62b6cd6ecb
                                                                                                                                                                                                    • Instruction ID: e78606f83f70677a78a2a57af9a96bce97e2e0d5e2824bbe2e7cff2ffa2fc024
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9bd7dbeddbf4d01ef53bd7e298c0cce26d155d1eb7edca795c507e62b6cd6ecb
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C321FC72A18A4186DB50CF29F4A076A63A5FF84B44F545131DB8D43764DF3CD599C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4BF84 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: X509_$Arg_M_clear_flagsM_get_flagsM_set_flagsParse_SizeX_get0_param
                                                                                                                                                                                                    • String ID: y
                                                                                                                                                                                                    • API String ID: 3791563005-3247811837
                                                                                                                                                                                                    • Opcode ID: 1d601c288d9fc5530c8c196e06302d87c0a067f9a29f5165f3821e0f5abb8ab5
                                                                                                                                                                                                    • Instruction ID: 94e6a54f373756b7d9e1ce66894fb611618dca283fcd68248a6f90f216370379
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1d601c288d9fc5530c8c196e06302d87c0a067f9a29f5165f3821e0f5abb8ab5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A1111CA6B0C74282FB218FA6E440179A7A0FF84B94F144135DA9D43765DF7CE4458F01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C50B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CallCloseDeallocErr_ErrorFunctionHandleLastObjectObject_OpenParseProcessTuple
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 3428877611-2746090705
                                                                                                                                                                                                    • Opcode ID: 32830bb26f24432cfe0f1c7db2f2a12bef79f90d27717a67b425f9d2116efd08
                                                                                                                                                                                                    • Instruction ID: de0d6315350d74d55133e7162c2f251c7626d2e757e39b07c714aeb3f3eab14b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 32830bb26f24432cfe0f1c7db2f2a12bef79f90d27717a67b425f9d2116efd08
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 32117C60F1C64682FB94DB26F9851BD62A1EF88BC0F488035DA4D4F7B6EE2CF8448700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48884 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ConverterDeallocErr_FormatJ_sn2nidR_clear_errorR_peek_last_errorUnicode_X_ctrl
                                                                                                                                                                                                    • String ID: unknown elliptic curve name %R
                                                                                                                                                                                                    • API String ID: 3792718242-553976147
                                                                                                                                                                                                    • Opcode ID: 7c66f2cc0b32c00bb0b19869bcdeb10d02ada59408435a5a4420990a8c1a6f58
                                                                                                                                                                                                    • Instruction ID: 3e0dcb29ae050b3353a3e2f5ef349ee8e900af1ad58d8ea07d3481027d8ba3e5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7c66f2cc0b32c00bb0b19869bcdeb10d02ada59408435a5a4420990a8c1a6f58
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 94110DB1A08B8282EB648F65E840179A3A1EF84B94F544031EB8D86A74DF7CD445CF01
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4BDC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_Err_Parse_SizeWarnX_clear_optionsX_get_optionsX_set_options
                                                                                                                                                                                                    • String ID: ssl.OP_NO_SSL*/ssl.OP_NO_TLS* options are deprecated
                                                                                                                                                                                                    • API String ID: 476201610-2795599882
                                                                                                                                                                                                    • Opcode ID: 52c39a1274e772b19ac20c37b0a4bd9b7e9e04d1be7742f5be71ff9978b3e02a
                                                                                                                                                                                                    • Instruction ID: 75049b3ca1762522ec80fda23ecf667202c6ad4e3e1ea760f1fb65629c35fb27
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 52c39a1274e772b19ac20c37b0a4bd9b7e9e04d1be7742f5be71ff9978b3e02a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 55110DA6B08B4282EB308F56F4846796761EFC4BD1F145535DB9E476B8CF2CE445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C4220 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CallCloseDeallocErr_ErrorFunctionHandleLastObjectObject_ParseProcessTerminateTuple
                                                                                                                                                                                                    • String ID: TerminateProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 4064933840-3562140098
                                                                                                                                                                                                    • Opcode ID: c600ac700403a6dceaf65354164ba4133551b4efe3aebd43a5abdd72155e4336
                                                                                                                                                                                                    • Instruction ID: e4840cab3cc5d35ef15c25c6c77550cfe58e7154b6a0ffe85c6861ad302465a5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c600ac700403a6dceaf65354164ba4133551b4efe3aebd43a5abdd72155e4336
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DE011E60F0954382FF959BA2F99627923A1EF98BC6F481035C90D4E6B1EE2CE8C5D300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44504 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: X_set_msg_callback$Callable_CheckDeallocErr_String
                                                                                                                                                                                                    • String ID: not a callable object
                                                                                                                                                                                                    • API String ID: 3435843511-3332612890
                                                                                                                                                                                                    • Opcode ID: 377ba27844469bf4563a1db69ae6946a45038825c2ee4883cf5ce53a87bd4dfa
                                                                                                                                                                                                    • Instruction ID: 77503aeb9d9c44735778bea6ba5ed74577a6138166a7d3fa2c2e728ca7def367
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 377ba27844469bf4563a1db69ae6946a45038825c2ee4883cf5ce53a87bd4dfa
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1811DBB1A09B4282FB249F65E94433923A1FF88B98F144531CAAE46574DF3CE4658B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4BD40 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_Err_Parse_SizeStringX_set_num_tickets
                                                                                                                                                                                                    • String ID: SSLContext is not a server context.$failed to set num tickets.$value must be non-negative
                                                                                                                                                                                                    • API String ID: 2130650243-3995814857
                                                                                                                                                                                                    • Opcode ID: 86a43d8334e733ea5fb36aaab4596c68f101ed5683ca7443b442053a3c2f6df6
                                                                                                                                                                                                    • Instruction ID: fee44794fea1d5ef9770e20c09c51583af2c19216c992a5e01877cfceef81727
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 86a43d8334e733ea5fb36aaab4596c68f101ed5683ca7443b442053a3c2f6df6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 73011AA1A0CB03C1EA749F69E8C41F82761EF45B90F944176CA9DA66B4DF6CE484CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C885C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$continue_pending
                                                                                                                                                                                                    • API String ID: 127882022-3850771874
                                                                                                                                                                                                    • Opcode ID: 563777eb47410e740992a52d1b5193deb7300e277ecd8ccdaa27b10e6241df0a
                                                                                                                                                                                                    • Instruction ID: f3ccfac4ffa6930454d1b7d3761f0659d219a78112d864c4a6402ee439a4e187
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 563777eb47410e740992a52d1b5193deb7300e277ecd8ccdaa27b10e6241df0a
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7AF01C65E0CA4781EB948B57A8441796371FF89BC4B484031D90E4BB78FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8853 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$pause_pending
                                                                                                                                                                                                    • API String ID: 127882022-461645825
                                                                                                                                                                                                    • Opcode ID: 287d4c72013fa67fd2366e2a88b226eaed780e417256c27843d909ce14e912fc
                                                                                                                                                                                                    • Instruction ID: e006ea72dc67b32d3850ebe4a9159ac1d55c1cbf77421f2e4e3b3aa6022ba8e9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 287d4c72013fa67fd2366e2a88b226eaed780e417256c27843d909ce14e912fc
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 74F01C65E0CA4781EB948B57A8441796371FF89BC4B484031D90E4BB78FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C884A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$start_pending
                                                                                                                                                                                                    • API String ID: 127882022-2023969894
                                                                                                                                                                                                    • Opcode ID: e1cae415a3e1726ff611fb799912e22b82523e717fd6f6739a845b1a57a08090
                                                                                                                                                                                                    • Instruction ID: a7338a2f844d4863414617626ed125c647746affed7f85099d9eac8ad6b9eff5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e1cae415a3e1726ff611fb799912e22b82523e717fd6f6739a845b1a57a08090
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 68F01C65F0CA4781EB948B57A8441796371FF89BC4B484031D90E4BB78FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8841 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$paused
                                                                                                                                                                                                    • API String ID: 127882022-3190322518
                                                                                                                                                                                                    • Opcode ID: 57d1f22f4c9028e155bceaf090778306476b2bb647a2d56a22d7d9a06826298c
                                                                                                                                                                                                    • Instruction ID: 5be497143cbd9353babc86ff26f3c3a81ec710f3ef0cf940726fced86a1c9022
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 57d1f22f4c9028e155bceaf090778306476b2bb647a2d56a22d7d9a06826298c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0DF01C65F0CA47C1EBD48B57A8441796371FF89BC4B484031D90E4B778FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C886E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$stopped
                                                                                                                                                                                                    • API String ID: 127882022-1133211610
                                                                                                                                                                                                    • Opcode ID: 3df425e2ff0c01b11f9525c6adb2e213cd0812a094ce122c53addede40e1846b
                                                                                                                                                                                                    • Instruction ID: ce458e8c178f4d285a8f303339730473aebeb749b4cc80fafed7ffd0d4ed0648
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3df425e2ff0c01b11f9525c6adb2e213cd0812a094ce122c53addede40e1846b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 80F01C65E0CA47C1EBD48B57A8441796371FF89BC4B484031D90E4B778FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8865 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$stop_pending
                                                                                                                                                                                                    • API String ID: 127882022-1930585124
                                                                                                                                                                                                    • Opcode ID: 83d4085c680cf67cabd3782d6d973ba5b52b1c9ad431a3c942613aeaef24c035
                                                                                                                                                                                                    • Instruction ID: 6f95ead49c5f42f1d657115dffbeca64c9d65dcbdfdee063003793d8b333f5c9
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 83d4085c680cf67cabd3782d6d973ba5b52b1c9ad431a3c942613aeaef24c035
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 86F01C65F0CA47C1EBD48B57A8441796371FF89BC4B484031D90E4B778FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8838 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22memoryserviceCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Heap$CloseFreeHandleProcessService$BuildValue
                                                                                                                                                                                                    • String ID: (sk)$running
                                                                                                                                                                                                    • API String ID: 127882022-3389828697
                                                                                                                                                                                                    • Opcode ID: 55c881d6a2c11eb950a2990d30635b0c3f7f658b4cd111fa102511ba4bbe77f9
                                                                                                                                                                                                    • Instruction ID: 8a52c30b691b9535fdb29750262ee736579490e604fbdf73aba49a3fca2eda77
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 55c881d6a2c11eb950a2990d30635b0c3f7f658b4cd111fa102511ba4bbe77f9
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 77F01C65E0CA4B81EB948B57A8441796371FF89BC4B484031D90E5BB78FE2CE8068700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48E14 Relevance: 9.1, APIs: 6, Instructions: 66COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocInsertL_get1_peer_certificateL_get_peer_cert_chainList_
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 710524685-0
                                                                                                                                                                                                    • Opcode ID: f748f3899e19415e0b0d8e34b979273fe1f87f8855e44adafaa9736646939af5
                                                                                                                                                                                                    • Instruction ID: 12bf877ff0f232b4af04437d2b359e01af609e24057ae03b87a44248db669ace
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f748f3899e19415e0b0d8e34b979273fe1f87f8855e44adafaa9736646939af5
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 092132B1A09B5281EA78CF2AE95413963A0EF88F94B084535DF9E477B4DF3CE851CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB445F4 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: List_$DeallocItemL_sk_numL_sk_valueX509_up_ref
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2540853196-0
                                                                                                                                                                                                    • Opcode ID: 7789607a003f9be8dd9e6d5c70abf723484ee6467bfeb0f4a62a957b25e54580
                                                                                                                                                                                                    • Instruction ID: 7291dd5a5fd723163558a8006d788f01aaa726631b0b25bdf88065d2900964c4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7789607a003f9be8dd9e6d5c70abf723484ee6467bfeb0f4a62a957b25e54580
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9D11B1A1A09B4281EA258F67A84413963F4FF88FE4B454531DEAD037A4DF3CE4528740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4AFB8 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Eval_Thread$O_free_allRestoreSave
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 86175192-0
                                                                                                                                                                                                    • Opcode ID: eb537489bffb64eed418cc875f85ec86de76296b8708b35895d12875b1d35120
                                                                                                                                                                                                    • Instruction ID: 7a6787dfff5a5294ec82af25360547ee44ec5473b29cf0ce1cfd58636969bc6e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: eb537489bffb64eed418cc875f85ec86de76296b8708b35895d12875b1d35120
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 161100F3A09B4292EB798F71D94833823A0FF48B54F040235CBC946A60CF3DE4A48700
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF81B3C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: abort$CallEncodePointerTranslator
                                                                                                                                                                                                    • String ID: MOC$RCC
                                                                                                                                                                                                    • API String ID: 2889003569-2084237596
                                                                                                                                                                                                    • Opcode ID: 415b55739cfe6c816ee0bf64f3aa1c118a5f5bf48e41dc984f05d79a212aa231
                                                                                                                                                                                                    • Instruction ID: 77230509921384d67ea2c5b57c763c5543eac588dbb859a91b5f1137aefe2867
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 415b55739cfe6c816ee0bf64f3aa1c118a5f5bf48e41dc984f05d79a212aa231
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 38915173A08B858AEB11DB69E8402AD7BE0FB45788F144239EE4D17765DF38D199C701
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_BuildCallCharCloseDeallocErr_ErrorFromFunctionHandleLastObjectObject_OpenParseProcessTupleUnicode_ValueWidefree
                                                                                                                                                                                                    • String ID: psutil_pid_is_running -> 0
                                                                                                                                                                                                    • API String ID: 2951710858-3467909595
                                                                                                                                                                                                    • Opcode ID: 881fde90a3211551788c6b80098edf1eb3ced60acf3b4532f416ce63fa98fd63
                                                                                                                                                                                                    • Instruction ID: a2d4e905595d855843f2b3413918042128f353877dea0c1ca5a3d60fdb8da285
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 881fde90a3211551788c6b80098edf1eb3ced60acf3b4532f416ce63fa98fd63
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 33118125B1C94382EBC08B55F946279B350EF807E4F804131DD5D4A6F8EE7CD086CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4411C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocErr_L_set_L_set_msg_callbackStringSubtypeType_
                                                                                                                                                                                                    • String ID: The value must be a SSLContext
                                                                                                                                                                                                    • API String ID: 40619448-677980480
                                                                                                                                                                                                    • Opcode ID: 0253c84fcfb29274ff2c65ba088d23e136020a2cef7a88cb10da044cdec780ae
                                                                                                                                                                                                    • Instruction ID: f63e360cd26862e1b16d07e91d48a10055efcb5bc820e263fd4a993e3bbefa1c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0253c84fcfb29274ff2c65ba088d23e136020a2cef7a88cb10da044cdec780ae
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DC11FAF6B08B4681EB249F26E98412827B1FB88FD8B109132CE9D47378DE28D454CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB41460 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • OBJ_txt2obj.LIBCRYPTO-3 ref: 00007FFE0EB41480
                                                                                                                                                                                                    • PyModule_GetState.PYTHON311 ref: 00007FFE0EB41495
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB414EA
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB414FC
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB41507
                                                                                                                                                                                                      • Part of subcall function 00007FFE0EB414C8: _Py_BuildValue_SizeT.PYTHON311(?,?,?,?,?,00007FFE0EB414A6), ref: 00007FFE0EB41535
                                                                                                                                                                                                    • ASN1_OBJECT_free.LIBCRYPTO-3 ref: 00007FFE0EB414AC
                                                                                                                                                                                                    • PyErr_Format.PYTHON311 ref: 00007FFE0EB43614
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BuildErr_FormatJ_nid2lnJ_nid2snJ_obj2nidJ_txt2objModule_SizeStateT_freeValue_
                                                                                                                                                                                                    • String ID: unknown object '%.100s'
                                                                                                                                                                                                    • API String ID: 2376969911-3113687063
                                                                                                                                                                                                    • Opcode ID: b5d45e1b3159c0210a2dcfbd056b4fed1a47d8c8d60440e740920665be194752
                                                                                                                                                                                                    • Instruction ID: 965fcc14cd021814a308fdb5eaa7ff5d4653fa872d49a1498a6e6986f2f37664
                                                                                                                                                                                                    • Opcode Fuzzy Hash: b5d45e1b3159c0210a2dcfbd056b4fed1a47d8c8d60440e740920665be194752
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E2F031A1B1DB4781EA64CF27A95403952A1EF88FD0B488030DE8E47B34DE2CD0858B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4AB78 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocErr_FormatFromModuleO_newO_s_memStateStringType_Unicode_X509_get_subject_name
                                                                                                                                                                                                    • String ID: <%s '%U'>
                                                                                                                                                                                                    • API String ID: 652521511-3496504151
                                                                                                                                                                                                    • Opcode ID: 28b50e0b3bb33707e285c0ff8cd6c5af6e4fe450884f712a2403ec4b29bfb8a0
                                                                                                                                                                                                    • Instruction ID: bf1e7c00b1ea4838aec81ae1f221206f3da2ed836bc43e61759a19223aa2e0b0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 28b50e0b3bb33707e285c0ff8cd6c5af6e4fe450884f712a2403ec4b29bfb8a0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 26013CA5B09B8681EE24CF16F94403963A1FB88FD4B085431DE8E47778DE3CE481CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C1180 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CallDeallocErr_FunctionObjectObject___stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: (is)$assume access denied (originated from %s)
                                                                                                                                                                                                    • API String ID: 1805293726-3664638754
                                                                                                                                                                                                    • Opcode ID: bc8b59b3d6b6355d02f00ec36d7aa5c06ce23d7349578e557eb6757c56fdee6b
                                                                                                                                                                                                    • Instruction ID: 394ff4734a12099d12b84def04d37df0ac5e2f3e4b3b94c3f0baf96e307c11a4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: bc8b59b3d6b6355d02f00ec36d7aa5c06ce23d7349578e557eb6757c56fdee6b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DD01ECA5B1898681EF90DF25E85137563A4FF98BC9F840032DA4D8F775DE2CD105C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C10E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CallDeallocErr_FunctionObjectObject___stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: (is)$assume no such process (originated from %s)
                                                                                                                                                                                                    • API String ID: 1805293726-1293061785
                                                                                                                                                                                                    • Opcode ID: 299a49546879b75f59c8e9310ed3a9af0b25771141eb6637bf67c1c670226fae
                                                                                                                                                                                                    • Instruction ID: b796c79523b8bccac03cec205c4234b7b052126205dfdeab2fa92c240264ddf3
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 299a49546879b75f59c8e9310ed3a9af0b25771141eb6637bf67c1c670226fae
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3101ECA1B1994681EF90DB21E85137563A4FF98BC9F840031DA4E8F775DE2CD209C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE13241120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Module_$FromInternObjectStateStringUnicode_
                                                                                                                                                                                                    • String ID: close$error
                                                                                                                                                                                                    • API String ID: 4029360594-371397155
                                                                                                                                                                                                    • Opcode ID: d1d56f56bfa3555b9ef12796d8bede51d7c66017a5d4b22be61f28461ee977ed
                                                                                                                                                                                                    • Instruction ID: caa8416d63b4584391c0b8ca60c8df85bb3d6e556a0cce464885cfaaed66c9b0
                                                                                                                                                                                                    • Opcode Fuzzy Hash: d1d56f56bfa3555b9ef12796d8bede51d7c66017a5d4b22be61f28461ee977ed
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C7F03A21B09E47D6EA04AB66F8540693360BFA9FA4B184176DA1D663B0DF3CE468C300
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE13242724 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: List_$DeallocItem
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1559017468-0
                                                                                                                                                                                                    • Opcode ID: ca1c250aef14b2cb80a943dd37ef050920af6dc516bc50837cea6f6d33c8ee49
                                                                                                                                                                                                    • Instruction ID: c4b9b8029a66e1b6c49d3c46de25a5867783f00c70ce79f959a433f556b2bffe
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ca1c250aef14b2cb80a943dd37ef050920af6dc516bc50837cea6f6d33c8ee49
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BB218B31A18F02CAEB10AF17A6042A973A0FBA9FA0F444475CB4D53760DF3CE166C340
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4C0EC Relevance: 7.6, APIs: 5, Instructions: 60encryptionCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CertStore$CloseOpen$Collection
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1995843185-0
                                                                                                                                                                                                    • Opcode ID: 47731ccde3f031e6a1784f907dec12855419cbc5570ade04c403346d6705aece
                                                                                                                                                                                                    • Instruction ID: b3ef51e114b92e7cc98c4124f3702db0934cb5cbeb155837a098a2320b3a32a1
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 47731ccde3f031e6a1784f907dec12855419cbc5570ade04c403346d6705aece
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CE212CB6B19B5286FB758F16A954729A7A1FB84F80F484434CE8D47B64DF38E5058A00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB43F60 Relevance: 7.5, APIs: 5, Instructions: 45COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: L_get_session
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1156357689-0
                                                                                                                                                                                                    • Opcode ID: fc3b97ac600673fcc778a6ae0b05831b65e307731326eb694e06251a1696786b
                                                                                                                                                                                                    • Instruction ID: 97b27a84d3aeb8b5724c0f2363c49cde2da972a80bc8ad9e00c86cd92136626a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: fc3b97ac600673fcc778a6ae0b05831b65e307731326eb694e06251a1696786b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E611D662A19B4681EE389F16E85413923B0FF98F84B180535DECE43775EF3CE4528B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0AA460 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: State_$AppendDeallocEnsureFromList_Object_ReleaseU_object@@
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1307292411-0
                                                                                                                                                                                                    • Opcode ID: 2da81ce98251997789bd95e6982422e9a0af280cbac30fa44f8514417ecc8a66
                                                                                                                                                                                                    • Instruction ID: 0a4663a7f66cb65d0e3f0c59652ca8f7e23410c665b28a7951f1fa0dc71f4e5a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2da81ce98251997789bd95e6982422e9a0af280cbac30fa44f8514417ecc8a66
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 37011731E4875286E7109B29B82402DB3A6AFC5B91F185135EB5E877B4DF3CD441C704
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4380C Relevance: 7.5, APIs: 5, Instructions: 26COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DeallocObject_$N_freeTrack
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1683932209-0
                                                                                                                                                                                                    • Opcode ID: 73466ddfc36bf957d1f27849d204b3954713433a3c8e205f38a25ddfc3ec53d8
                                                                                                                                                                                                    • Instruction ID: 924295d9671778019d03b359c4372b6bc0e93f8a1c5c41af76176bdc5af1df04
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 73466ddfc36bf957d1f27849d204b3954713433a3c8e205f38a25ddfc3ec53d8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6CF0F8B6E09B42C1EB699F75E95413C63B0EF98FA4B085030CEDE02624CE3EE495CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF820B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                      • Part of subcall function 00007FFE0CF834FC: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FFE0CF81222), ref: 00007FFE0CF8353C
                                                                                                                                                                                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE0CF8222F
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: abort
                                                                                                                                                                                                    • String ID: $csm$csm
                                                                                                                                                                                                    • API String ID: 4206212132-1512788406
                                                                                                                                                                                                    • Opcode ID: dfb13a1d0044ae19a6d4b53525c6503561b35a1894cc0a4fa4ff32093aa6b369
                                                                                                                                                                                                    • Instruction ID: 24abba4eee532a8fa7333dffe23b3dbd611fde86d66bb39e4e488824062404dd
                                                                                                                                                                                                    • Opcode Fuzzy Hash: dfb13a1d0044ae19a6d4b53525c6503561b35a1894cc0a4fa4ff32093aa6b369
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9571BE72948A8186E7658F29D490779BBE0FF05B85F148135EF8C17AA9CF3CE499C702
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0C0A6C7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905690457.00007FFE0C0A1000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00007FFE0C0A0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905515321.00007FFE0C0A0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905731316.00007FFE0C0B1000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905767616.00007FFE0C0BB000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905812741.00007FFE0C0BE000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0c0a0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Tuple_
                                                                                                                                                                                                    • String ID: CERT_ALT_NAME_ENTRY %d is not yet supported
                                                                                                                                                                                                    • API String ID: 3728983458-143101820
                                                                                                                                                                                                    • Opcode ID: 8b8a282126e4b4783f6b230fc72f71cb4dd8030e10860e6f5e33ceedb6805a1f
                                                                                                                                                                                                    • Instruction ID: 58061fa424e6f2b62ab9613b42478936129c218025caf552ed6cb6f4072d49e5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8b8a282126e4b4783f6b230fc72f71cb4dd8030e10860e6f5e33ceedb6805a1f
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 13318D33A08742C6DB04CF15E891468B7BAFB84B98B585021EB4D47BA4DF7CE544CB14
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB22310 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1908816347.00007FFE0EB21000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FFE0EB20000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908712620.00007FFE0EB20000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908843001.00007FFE0EB24000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908867951.00007FFE0EB25000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1908898664.00007FFE0EB26000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb20000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: _wassertmemcpy
                                                                                                                                                                                                    • String ID: hs->curlen < BLOCK_SIZE$src/SHA1.c
                                                                                                                                                                                                    • API String ID: 785382960-330188172
                                                                                                                                                                                                    • Opcode ID: cce9c3492d54589ff30e15847476375fec3a39db9827f708beda0d4bf1d6b35c
                                                                                                                                                                                                    • Instruction ID: f0e0526c9d3d74c86549db8056432106fc6db9df7993014f5b1b369ec49ee0a7
                                                                                                                                                                                                    • Opcode Fuzzy Hash: cce9c3492d54589ff30e15847476375fec3a39db9827f708beda0d4bf1d6b35c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9421A432B186518AEB688F15E55037D6761FF65B88F189039DA8E47B79CE3CDC858B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyArg_ParseTuple.PYTHON3 ref: 00007FFE014C727C
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C7C90: OpenProcess.KERNEL32(?,?,?,00007FFE014C4116), ref: 00007FFE014C7CAA
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C7C90: GetLastError.KERNEL32(?,?,?,00007FFE014C4116), ref: 00007FFE014C7CB8
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C7C90: CloseHandle.KERNEL32(?,?,?,00007FFE014C4116), ref: 00007FFE014C7CD5
                                                                                                                                                                                                    • PyUnicode_FromWideChar.PYTHON3 ref: 00007FFE014C72EC
                                                                                                                                                                                                    • free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE014C72FD
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C10E0: PyObject_CallFunction.PYTHON3 ref: 00007FFE014C112B
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C10E0: PyErr_SetObject.PYTHON3 ref: 00007FFE014C1141
                                                                                                                                                                                                      • Part of subcall function 00007FFE014C10E0: _Py_Dealloc.PYTHON3 ref: 00007FFE014C1155
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CallCharCloseDeallocErr_ErrorFromFunctionHandleLastObjectObject_OpenParseProcessTupleUnicode_Widefree
                                                                                                                                                                                                    • String ID: psutil_pid_is_running -> 0
                                                                                                                                                                                                    • API String ID: 1842087324-3467909595
                                                                                                                                                                                                    • Opcode ID: 1f9a23fe0a50f63d0b14dec4f87546fd3ef4b7faad2a2f5b4d81b33802082ae8
                                                                                                                                                                                                    • Instruction ID: edd2c3bc5bbda95d0e71ab720249d95edd7fa0a396ebdda89978157f46924e00
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1f9a23fe0a50f63d0b14dec4f87546fd3ef4b7faad2a2f5b4d81b33802082ae8
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 59115465B08A8283EB808B66F9411BAB361EF847F5F444231DE6D4B6F5EE7CD445CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46620 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CheckErr_Long_OccurredPositional
                                                                                                                                                                                                    • String ID: read
                                                                                                                                                                                                    • API String ID: 3612027452-2555855207
                                                                                                                                                                                                    • Opcode ID: 507dea7fd97e8f8ae6bba4816266088c53b9b9968d0fdb56ffef30ba5b561219
                                                                                                                                                                                                    • Instruction ID: 610c024f037f8c55a0d85eb0bf28b173bcdc093477224b1a6e033b0650ec214e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 507dea7fd97e8f8ae6bba4816266088c53b9b9968d0fdb56ffef30ba5b561219
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9101B5B1B04B9185EB60AF66A8401A963A4FB89FD0B594135DE9D877B8DF3CE841CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4AA78 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • PyUnicode_InternFromString.PYTHON311(?,?,00000000,00007FFE0EB4A183), ref: 00007FFE0EB4AA93
                                                                                                                                                                                                    • PyUnicode_InternFromString.PYTHON311(?,?,00000000,00007FFE0EB4A183), ref: 00007FFE0EB4AAB8
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: FromInternStringUnicode_
                                                                                                                                                                                                    • String ID: pkcs_7_asn$x509_asn
                                                                                                                                                                                                    • API String ID: 3337471625-3375957347
                                                                                                                                                                                                    • Opcode ID: a8c89ea16d65e06874ab2bd1a4f3f59f7e9b8207b6c57c2bae04b4f51f503c0c
                                                                                                                                                                                                    • Instruction ID: 2867232855bfcdc863a861348b23399220ad57eddaa467625dd3e0629579b38c
                                                                                                                                                                                                    • Opcode Fuzzy Hash: a8c89ea16d65e06874ab2bd1a4f3f59f7e9b8207b6c57c2bae04b4f51f503c0c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C201DA60F4AF0785FE7A8F15A9E013423A1EF58748B140835CA9E423B0FE3CB495DB50
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C3470 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BuildErr_FromInfoPerformanceValueWindows
                                                                                                                                                                                                    • String ID: (LLLL)
                                                                                                                                                                                                    • API String ID: 964912588-1895995636
                                                                                                                                                                                                    • Opcode ID: 8d64717707a48ea585f3e69a4e7ef28cd76746e5fc2058fd23a2e64ff3ee9859
                                                                                                                                                                                                    • Instruction ID: 66d827f59edfe49aa4ee2dcf60a00347a231e723e0e1857e8b24c3997996df1a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8d64717707a48ea585f3e69a4e7ef28cd76746e5fc2058fd23a2e64ff3ee9859
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 25015265B18A8481EB94DB61F45236AA368FBD8784F805036D9CE47774DE2CD009CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C7C10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorLastOpenProcess
                                                                                                                                                                                                    • String ID: OpenProcess$automatically set for PID 0
                                                                                                                                                                                                    • API String ID: 919517065-2746090705
                                                                                                                                                                                                    • Opcode ID: 3f61fa6f0bea6c43d8e9c556224f20c09874aa0c6caedbbee4f96f2dde940cae
                                                                                                                                                                                                    • Instruction ID: 37d4245dbcf4f215b08d5f1099160506061e77c8d02b11ee1ab718376a761c10
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3f61fa6f0bea6c43d8e9c556224f20c09874aa0c6caedbbee4f96f2dde940cae
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 15F09020F29A4783FBD8876669D503962D1AF987D5F442434D90E8F7B4EE2CE8918B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46204 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_StringX_get_verify_callbackX_set_verify
                                                                                                                                                                                                    • String ID: invalid value for verify_mode
                                                                                                                                                                                                    • API String ID: 93861573-2668209411
                                                                                                                                                                                                    • Opcode ID: 44e7c4b1fcdaf7b470f4525e9cca5261007454cc6989eb36cf290ba0fa3502e6
                                                                                                                                                                                                    • Instruction ID: ed61e63fac0496e510c9088a92b6acf707f7478b84b7e206b59ebd4af411e423
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 44e7c4b1fcdaf7b470f4525e9cca5261007454cc6989eb36cf290ba0fa3502e6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 28F062B5F08B0291EB70CFAAE49413813A1FF89B94F548136CA9D476B9CE3CD4858B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C8000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: BuildErr_FromPowerStatusSystemValueWindows
                                                                                                                                                                                                    • String ID: iiiI
                                                                                                                                                                                                    • API String ID: 2045901803-2605956832
                                                                                                                                                                                                    • Opcode ID: e52a50b647170e53c6b85427214598846258566c92c21a7db17d41ddce193d98
                                                                                                                                                                                                    • Instruction ID: 0e88d417fd394d0bb1f1f070bb94a58babc099003929c0a2e1cb199f06d5ad3f
                                                                                                                                                                                                    • Opcode Fuzzy Hash: e52a50b647170e53c6b85427214598846258566c92c21a7db17d41ddce193d98
                                                                                                                                                                                                    • Instruction Fuzzy Hash: C9F04461B2D9C286EBD19B31B82603E77A0FF99784F801035F6CE46A75EE2CD1058F00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF81268 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                      • Part of subcall function 00007FFE0CF834FC: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FFE0CF81222), ref: 00007FFE0CF8353C
                                                                                                                                                                                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE0CF812A6
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: abortterminate
                                                                                                                                                                                                    • String ID: MOC$RCC$csm
                                                                                                                                                                                                    • API String ID: 661698970-2671469338
                                                                                                                                                                                                    • Opcode ID: 959f04728602a81433a0b6c3a82064beabd568bdef91fbca2d9194c842358ce4
                                                                                                                                                                                                    • Instruction ID: 04510ec8bfa47c8b3181de186ce16cab0387462a1730b307d3839286cec3f02a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 959f04728602a81433a0b6c3a82064beabd568bdef91fbca2d9194c842358ce4
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 84F06D36998646C7E7506F29E58216C36F4EF48B40F099231DB48472B2CF3CE8A9CB02
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB446BC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: DecodeErr_O_ctrlStringUnicode_
                                                                                                                                                                                                    • String ID: Not a memory BIO
                                                                                                                                                                                                    • API String ID: 3520065620-587638661
                                                                                                                                                                                                    • Opcode ID: ef302d2e3081120f51d37f54aa49bf18da05ec199c0c23ee270cf43e51a9a37c
                                                                                                                                                                                                    • Instruction ID: a3a04f5fe43e66e4093ad291809866a1c6137125c7d21a534985770c6dc2738e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ef302d2e3081120f51d37f54aa49bf18da05ec199c0c23ee270cf43e51a9a37c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7AF090A6A2974282EB208F61F4447756360EF85B94F404031DE8E46A34DF3CE559CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB499A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: L_get_versionL_is_init_finishedstrcmp
                                                                                                                                                                                                    • String ID: unknown
                                                                                                                                                                                                    • API String ID: 1061301088-2904991687
                                                                                                                                                                                                    • Opcode ID: 603bbdfd0d8e6bc930a99feee0a2e835999740c99c84c5aa51e7a3c203c3eb00
                                                                                                                                                                                                    • Instruction ID: 6e5182fc48ec913a592fc2fdb80e237f772d289393f0888e21a710243a1b536e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 603bbdfd0d8e6bc930a99feee0a2e835999740c99c84c5aa51e7a3c203c3eb00
                                                                                                                                                                                                    • Instruction Fuzzy Hash: BFF01CA1B0970780EE298F66A8A017923A0EF88B84B081435CE8D4B374DE2CE4D2CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44598 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: String$Bytes_Err_FromO_ctrlSize
                                                                                                                                                                                                    • String ID: Not a memory BIO
                                                                                                                                                                                                    • API String ID: 2349510700-587638661
                                                                                                                                                                                                    • Opcode ID: 3bd5966dc2c3ec777c25abbce76a21e6584b7da2302407295a0b82d20404e016
                                                                                                                                                                                                    • Instruction ID: a3ff9c76ddfe097eddc2012b288983859244cfedf7b3a5b073473192016bec06
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3bd5966dc2c3ec777c25abbce76a21e6584b7da2302407295a0b82d20404e016
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5EF0F4A5A2974682EB64DF21E45477963A1FF84B54F809131D98E86974CF3CD4588F00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB44028 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                    • Opcode ID: 93c000e5e0e4e7b58fd8bd24c56a6fa4fb54b0b554a2a203c34d5c6685705d42
                                                                                                                                                                                                    • Instruction ID: f2daf757f54972c9888b93ebca2e9f17b63d6cb538e244d5ed934cace645b41e
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 93c000e5e0e4e7b58fd8bd24c56a6fa4fb54b0b554a2a203c34d5c6685705d42
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E221B272A1DB8682EB318F24E45076A63A0FB48754F140635CAED47BA4EF3DE8648B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB49090 Relevance: 6.0, APIs: 4, Instructions: 42threadCOMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Eval_Thread$ErrorFromL_get_errorL_pendingLastLongLong_R_clear_errorR_peek_last_errorRestoreSave_errno
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1598009871-0
                                                                                                                                                                                                    • Opcode ID: c51fe239555ab468b580b2a0d7759f28038f3ca27c0a57fe5258663b4b163a4b
                                                                                                                                                                                                    • Instruction ID: f57c494a977d589bfb8feddd8c49dce6d5d06c34b00f0ec73453c3194e7addb5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c51fe239555ab468b580b2a0d7759f28038f3ca27c0a57fe5258663b4b163a4b
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 27117C66A08F828AD720DF25E40006EA760FF89BD4B144135EF8957B68DF3CD4818B40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE132416AC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1911657152.00007FFE13241000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE13240000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911592534.00007FFE13240000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911689251.00007FFE13243000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911715438.00007FFE13245000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1911746398.00007FFE13246000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe13240000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2933794660-0
                                                                                                                                                                                                    • Opcode ID: f759169f25021b1a22403e83b5a1eb6cde424f4415f6ba0e28358bdbc9764cf0
                                                                                                                                                                                                    • Instruction ID: 7d76838f71c1d72ea15c2bba0faa7a58b4e8ee2b9ae9a12d7d0447c0cffb2ef2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f759169f25021b1a22403e83b5a1eb6cde424f4415f6ba0e28358bdbc9764cf0
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 39112E26B14F01C9EB00DF61E8552B833A4FB69B68F441E31DAAD56BA4DF78D168C740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB42BAC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2933794660-0
                                                                                                                                                                                                    • Opcode ID: 1174b9e05e0ec077f58f84e71c627ec51327c8a58e7600726c525f8141592f8c
                                                                                                                                                                                                    • Instruction ID: 5addbdca743c7e0a48ce3ab6fc6d2ad9d74cd3460fde7fc9fe59308df9f5c447
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1174b9e05e0ec077f58f84e71c627ec51327c8a58e7600726c525f8141592f8c
                                                                                                                                                                                                    • Instruction Fuzzy Hash: E8112A22B14F068AEB20DF61E8642B833A4FB59758F440E31EAAD477A4DF7CD1998740
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF8453C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 2933794660-0
                                                                                                                                                                                                    • Opcode ID: 7cd6a416b24dbc5e49de2362387c8759ef165b1766214851de74db2a672abbf1
                                                                                                                                                                                                    • Instruction ID: eec0c2a6522dad9df43d190e1c1669fea48d8ca4842963c13e83685d34526459
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7cd6a416b24dbc5e49de2362387c8759ef165b1766214851de74db2a672abbf1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: A4112A26B54F028AFB10CF64E8542B833A4FB19768F440E31DA6D467A4DF7CD1988381
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48974 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: P_get_type$J_nid2snL_get_current_compression
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 142675065-0
                                                                                                                                                                                                    • Opcode ID: bc1981206cf8cc9495a7d600c6abc60dcd81a012f917efe8ccbf6f55cedb2fb1
                                                                                                                                                                                                    • Instruction ID: 5269b27feac2efbead0df90a8efcb7f8b053ef901a24d009870b70a245d20093
                                                                                                                                                                                                    • Opcode Fuzzy Hash: bc1981206cf8cc9495a7d600c6abc60dcd81a012f917efe8ccbf6f55cedb2fb1
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4AF09EA5F0EB0781FE7D9F59A8546381390EF48F51B081434CD9E063B0DE2DE495DA51
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4B048 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Dealloc$Eval_Thread$FreeMem_O_free_allObject_RestoreSaveTrackX_free
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 3459953665-0
                                                                                                                                                                                                    • Opcode ID: 83d9ad1c206b6d19d983411814d0795c704b2402b66a0a142063596fc835247e
                                                                                                                                                                                                    • Instruction ID: 6d9e070afba1d94ceb673d38c7fe6090c4739e84caf903dc58a4e7b11023f3ce
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 83d9ad1c206b6d19d983411814d0795c704b2402b66a0a142063596fc835247e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 52F0F2B6A08B8682EB249F26E98403C6370FB89F95B085030DF8E07364CE38D895CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF825E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                      • Part of subcall function 00007FFE0CF834FC: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FFE0CF81222), ref: 00007FFE0CF8353C
                                                                                                                                                                                                    • _CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE0CF826B6
                                                                                                                                                                                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE0CF82714
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: abort$CreateFrameInfo
                                                                                                                                                                                                    • String ID: csm
                                                                                                                                                                                                    • API String ID: 2697087660-1018135373
                                                                                                                                                                                                    • Opcode ID: 38db9c11bde365fe9e894775720f0754f8382e2c52f7966776c48f209a7017e6
                                                                                                                                                                                                    • Instruction ID: 3c4eb475f531effd59c2900629707dcea5375901778725f1ae8c12990741a5ea
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 38db9c11bde365fe9e894775720f0754f8382e2c52f7966776c48f209a7017e6
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 69515E76658B8186EA209F1AE44166E77E4FF88B90F141135DB8D07B76CF3CE459CB02
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB46FE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_FreeMem_Parse_Size
                                                                                                                                                                                                    • String ID: ascii
                                                                                                                                                                                                    • API String ID: 2971325497-3510295289
                                                                                                                                                                                                    • Opcode ID: ce6952667f6606c06d7cb0e731b7de4cac13b1d99e45f8ce0efb53b33aa20faf
                                                                                                                                                                                                    • Instruction ID: 01aadd2588e15fcbad7f7d011fc59c79e9a0fc7f1228431114e8b3fa64e0d19b
                                                                                                                                                                                                    • Opcode Fuzzy Hash: ce6952667f6606c06d7cb0e731b7de4cac13b1d99e45f8ce0efb53b33aa20faf
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 08110776608B9281EA20CF16F880569B7A4FB88B84F584136EFCC93B24DF38D455CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_FreeMem_Parse_Size
                                                                                                                                                                                                    • String ID: ascii
                                                                                                                                                                                                    • API String ID: 2971325497-3510295289
                                                                                                                                                                                                    • Opcode ID: cfd1c2c4e6da76a709b4eb18149a69862ffc327e07715e87c8d6235b0a66f057
                                                                                                                                                                                                    • Instruction ID: fe5e8ac66acd6c5023dc5800016ade2930178dbbf9b051151acd0832a3d9e31a
                                                                                                                                                                                                    • Opcode Fuzzy Hash: cfd1c2c4e6da76a709b4eb18149a69862ffc327e07715e87c8d6235b0a66f057
                                                                                                                                                                                                    • Instruction Fuzzy Hash: DC114C62A18B5581EB208F56F444B6A77A4FB48BC4F140236EACD57B28DF7CD441CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF83214 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                    • String ID: csm
                                                                                                                                                                                                    • API String ID: 2573137834-1018135373
                                                                                                                                                                                                    • Opcode ID: 773630a601210f53501a9ddf254d547572cffa7b210bb5d13eb4ac83e88bb2ad
                                                                                                                                                                                                    • Instruction ID: aa19e90a715cbcccde51d32a7eebc9bde339f69d1090e9ba3776e47a327dbca7
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 773630a601210f53501a9ddf254d547572cffa7b210bb5d13eb4ac83e88bb2ad
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CE110A32619B8182EB618F19E84026977E5FF88B94F584231DE8D07B78DF3CD5598B41
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB48F48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Arg_CheckObject_PositionalTrue
                                                                                                                                                                                                    • String ID: getpeercert
                                                                                                                                                                                                    • API String ID: 341638686-200429401
                                                                                                                                                                                                    • Opcode ID: 9a1ca26cf022555671bcbfb2905af79a3247af999344541874e335c4e620ee16
                                                                                                                                                                                                    • Instruction ID: a163ba92a7e496a6f8aa4f1b511b0bfc15b706b62847586371aafb61bed3ed36
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9a1ca26cf022555671bcbfb2905af79a3247af999344541874e335c4e620ee16
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4C018F72B04B9186E7649F22E840169B6A5FB88FC0B594031EE8D87778CF39E881CB00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C1350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_ErrorFilenameFromStatusWindowsWith
                                                                                                                                                                                                    • String ID: (originated from %s)
                                                                                                                                                                                                    • API String ID: 3439497670-1804376747
                                                                                                                                                                                                    • Opcode ID: c205e873cf5473268db64a35648b3d4fdcbbbb94b0ea44075bdfa81be16ef224
                                                                                                                                                                                                    • Instruction ID: a8776650a55cddfcf837439616de1ffa1b9803a66d9a01349c61dc04373fa80d
                                                                                                                                                                                                    • Opcode Fuzzy Hash: c205e873cf5473268db64a35648b3d4fdcbbbb94b0ea44075bdfa81be16ef224
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 24F062A2B1CA85C1EBA08B25F85137962A0FB487D8F801131EA8D8B77ADE2CD1458708
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4C034 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    • Cannot set verify_mode to CERT_NONE when check_hostname is enabled., xrefs: 00007FFE0EB4C072
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_String$Arg_Parse_Size
                                                                                                                                                                                                    • String ID: Cannot set verify_mode to CERT_NONE when check_hostname is enabled.
                                                                                                                                                                                                    • API String ID: 1619524773-288992553
                                                                                                                                                                                                    • Opcode ID: 0ec6bb1e8d3cf5dc8959144528b93540dadccd29b45d171a85c4f86113c10747
                                                                                                                                                                                                    • Instruction ID: 071d9113f329fe97efd955061a0b8c0cdb9a270f90f13a190926df10cc248ee2
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0ec6bb1e8d3cf5dc8959144528b93540dadccd29b45d171a85c4f86113c10747
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9FF01DA1E09703C1FF358F65A4405756760EF94B94B148132CA9D067B4DE7DE4848F80
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4B5C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_StringX_get_verify_mode
                                                                                                                                                                                                    • String ID: invalid return value from SSL_CTX_get_verify_mode
                                                                                                                                                                                                    • API String ID: 3939857436-2501269723
                                                                                                                                                                                                    • Opcode ID: 74c2f2ff3e912cac661dc845afb49c4767801f071e3b2edaa1558e4497507610
                                                                                                                                                                                                    • Instruction ID: 9a8c8071488e24a85e916d2eaea12a0f1632ce82410b7c947bec96713c0c34e5
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 74c2f2ff3e912cac661dc845afb49c4767801f071e3b2edaa1558e4497507610
                                                                                                                                                                                                    • Instruction Fuzzy Hash: ADF065A2F18E0781FF398F65D8961785360EB48B08F180435C74E8A6B0CD6CD8D2CB40
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE014C1070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905228229.00007FFE014C1000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FFE014C0000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905198219.00007FFE014C0000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905260318.00007FFE014CB000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905292657.00007FFE014D0000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905360143.00007FFE014D1000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe014c0000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_ErrorFilenameFromLastWindowsWith__stdio_common_vsprintf
                                                                                                                                                                                                    • String ID: (originated from %s)
                                                                                                                                                                                                    • API String ID: 4225285543-1804376747
                                                                                                                                                                                                    • Opcode ID: 6fbf8b81ade6235c9ea28ef91b5d00b3f1765c8a2be8a883f430b5d27db14f95
                                                                                                                                                                                                    • Instruction ID: 1d009e579a5328bf00244bf2c5ebae97135ed789502712be2116cf9dc49435f8
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6fbf8b81ade6235c9ea28ef91b5d00b3f1765c8a2be8a883f430b5d27db14f95
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 51F03AA1718A8582EBA09B25F4553AA63A0FB8C7C8F840531DA8C4B67ADE3CD1458B04
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB42510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Capsule_ImportModule_State
                                                                                                                                                                                                    • String ID: _socket.CAPI
                                                                                                                                                                                                    • API String ID: 2652237932-3774308389
                                                                                                                                                                                                    • Opcode ID: f6bb12bf27002d4cccd5b8b37b61f5c59dc24c3f8fd27b4ee6771e3e226dd6f3
                                                                                                                                                                                                    • Instruction ID: 9698469874da3dec10f839ecf8a36e86ed0dcbc3fbf3945dbcdd3562a1a0d3c4
                                                                                                                                                                                                    • Opcode Fuzzy Hash: f6bb12bf27002d4cccd5b8b37b61f5c59dc24c3f8fd27b4ee6771e3e226dd6f3
                                                                                                                                                                                                    • Instruction Fuzzy Hash: D3E04FA1E1A70291FF348F70946533823A0EF58B20F680534C9AD863F0EE3CD4859B10
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0EB4BE6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    Strings
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1909140329.00007FFE0EB41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE0EB40000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909116624.00007FFE0EB40000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909170123.00007FFE0EB4D000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909201787.00007FFE0EB60000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909227042.00007FFE0EB61000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1909253939.00007FFE0EB69000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0eb40000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: Err_Object_StringTrue
                                                                                                                                                                                                    • String ID: cannot delete attribute
                                                                                                                                                                                                    • API String ID: 1323943456-1747274469
                                                                                                                                                                                                    • Opcode ID: bd151e0ae1931c1108789ebf41002dd0c792a5f115bc81628d656c0f0636c332
                                                                                                                                                                                                    • Instruction ID: 54aa9aeb633a7f2ba4026b05eaef0a88df80f6a9607d0a94259a8ac095e24568
                                                                                                                                                                                                    • Opcode Fuzzy Hash: bd151e0ae1931c1108789ebf41002dd0c792a5f115bc81628d656c0f0636c332
                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2FE012E5A18607C1EB749F75A4C413423A1EF95764B104B31CBAD861F0EF2CD4998B00
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                                                                    Function 00007FFE0CF8343C Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                    APIs
                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FFE0CF832ED,?,?,?,?,00007FFE0CF8419A,?,?,?,?,?), ref: 00007FFE0CF8345B
                                                                                                                                                                                                    • SetLastError.KERNEL32(?,?,?,00007FFE0CF832ED,?,?,?,?,00007FFE0CF8419A,?,?,?,?,?), ref: 00007FFE0CF834E3
                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                    • Source File: 00000002.00000002.1905935949.00007FFE0CF81000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FFE0CF80000, based on PE: true
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905869985.00007FFE0CF80000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1905982265.00007FFE0CF85000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906013539.00007FFE0CF88000.00000004.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    • Associated: 00000002.00000002.1906055392.00007FFE0CF89000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                    • Snapshot File: hcaresult_2_2_7ffe0cf80000_prank.jbxd
                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                    • API ID: ErrorLast
                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                    • API String ID: 1452528299-0
                                                                                                                                                                                                    • Opcode ID: 132749c40bd0ba5ebb6955e424a6ad121b3b2b2249ec90cc81fed750c6e1c92e
                                                                                                                                                                                                    • Instruction ID: ba6f7f4ec3842e3411eead447b13b1b9f6288d6f1316174db1af7fea6a2f6847
                                                                                                                                                                                                    • Opcode Fuzzy Hash: 132749c40bd0ba5ebb6955e424a6ad121b3b2b2249ec90cc81fed750c6e1c92e
                                                                                                                                                                                                    • Instruction Fuzzy Hash: CB11DA60E8D61682FE659B2AA85413922D1AF48FE0F544634DA2E077F5DF3CE84D8702
                                                                                                                                                                                                    Uniqueness

                                                                                                                                                                                                    Uniqueness Score: -1.00%