Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Colby Dupe Script.exe

Overview

General Information

Sample name:Colby Dupe Script.exe
Analysis ID:1441703
MD5:67bd09879e6fe66763074091f57f3150
SHA1:43825d37d0821a6a21aee73e30ecb71c04b14119
SHA256:5604246ead9eb4b6ddd749a285e1bb3296f186988c3eb298964a3138cece1446
Tags:exe
Infos:

Detection

Luna Logger
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected Luna Logger
Potentially malicious time measurement code found
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Colby Dupe Script.exe (PID: 5912 cmdline: "C:\Users\user\Desktop\Colby Dupe Script.exe" MD5: 67BD09879E6FE66763074091F57F3150)
    • Colby Dupe Script.exe (PID: 7052 cmdline: "C:\Users\user\Desktop\Colby Dupe Script.exe" MD5: 67BD09879E6FE66763074091F57F3150)
      • cmd.exe (PID: 2680 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LunaLoggerYara detected Luna LoggerJoe Security
      00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LunaLoggerYara detected Luna LoggerJoe Security
          00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 21 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsrAvira URL Cloud: Label: malware
            Source: https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsAvira URL Cloud: Label: malware
            Multi AV Scanner detection for submitted file
            Source: Colby Dupe Script.exeReversingLabs: Detection: 50%
            Source: Colby Dupe Script.exeVirustotal: Detection: 35%Perma Link
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\dd_setup.txtJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
            Source: Colby Dupe Script.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: Colby Dupe Script.exe, 00000001.00000002.1729225966.00007FFE004B1000.00000040.00000001.01000000.00000011.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: Colby Dupe Script.exe
            Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1728246199.00007FFDFF2C6000.00000040.00000001.01000000.00000015.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: Colby Dupe Script.exe, 00000001.00000002.1729061849.00007FFE004A1000.00000040.00000001.01000000.00000032.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: Colby Dupe Script.exe, 00000001.00000002.1729225966.00007FFE004B1000.00000040.00000001.01000000.00000011.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1728657653.00007FFDFFAF1000.00000040.00000001.01000000.00000033.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: Colby Dupe Script.exe, 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\python3.pdb source: Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718569021.0000012E32130000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Colby Dupe Script.exe, 00000000.00000003.1617973037.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732985131.00007FFE14641000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731795476.00007FFE126D1000.00000040.00000001.01000000.00000007.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Colby Dupe Script.exe, 00000000.00000003.1617973037.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732985131.00007FFE14641000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730410375.00007FFE0EB21000.00000040.00000001.01000000.00000018.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: Colby Dupe Script.exe, 00000001.00000002.1732322580.00007FFE13201000.00000040.00000001.01000000.0000000E.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\python310.pdb source: Colby Dupe Script.exe, 00000001.00000002.1727473962.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731982148.00007FFE12E11000.00000040.00000001.01000000.00000017.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730594110.00007FFE0EB41000.00000040.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Colby Dupe Script.exe, 00000000.00000003.1618083988.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732185301.00007FFE130C5000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: Colby Dupe Script.exe, 00000001.00000002.1731264639.00007FFE11EBC000.00000040.00000001.01000000.0000000A.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731264639.00007FFE11EBC000.00000040.00000001.01000000.0000000A.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: Colby Dupe Script.exe, 00000001.00000002.1730245094.00007FFE0E161000.00000040.00000001.01000000.00000012.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: Colby Dupe Script.exe, 00000001.00000002.1732500989.00007FFE13381000.00000040.00000001.01000000.0000000D.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: Colby Dupe Script.exe, 00000001.00000002.1726484532.00007FFDFAF2C000.00000040.00000001.01000000.0000001E.sdmp
            Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: Colby Dupe Script.exe, 00000001.00000002.1728246199.00007FFDFF2C6000.00000040.00000001.01000000.00000015.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730245094.00007FFE0E161000.00000040.00000001.01000000.00000012.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731103648.00007FFE10301000.00000040.00000001.01000000.0000000C.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730106014.00007FFE0E131000.00000040.00000001.01000000.00000013.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: Colby Dupe Script.exe, 00000001.00000002.1730594110.00007FFE0EB41000.00000040.00000001.01000000.0000000F.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731542743.00007FFE11ED1000.00000040.00000001.01000000.00000009.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: Colby Dupe Script.exe, 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Colby Dupe Script.exe, 00000000.00000003.1618083988.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732185301.00007FFE130C5000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: Colby Dupe Script.exe, 00000001.00000002.1729845180.00007FFE0CFB1000.00000040.00000001.01000000.0000001B.sdmp
            Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: Colby Dupe Script.exe
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb!! source: Colby Dupe Script.exe, 00000001.00000002.1728657653.00007FFDFFAF1000.00000040.00000001.01000000.00000033.sdmp
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE8D00 FindFirstFileExW,FindClose,0_2_00007FF698EE8D00
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF698EF8670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F026C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF698F026C4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF698EF8670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C3229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,1_2_00007FFDFB0C3229
            Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
            Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: api.ipify.org
            Source: Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E3470C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
            Source: Colby Dupe Script.exe, 00000001.00000002.1721233798.0000012E33A40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
            Source: Colby Dupe Script.exe, 00000001.00000002.1721233798.0000012E33A40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27P:
            Source: Colby Dupe Script.exe, 00000001.00000003.1715388690.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713541464.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705854816.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710461872.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714437345.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710314552.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717384939.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D50000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707392854.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706027731.0000012E33567000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720717142.0000012E3358B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712670599.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716103204.0000012E335F9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720805133.0000012E335FB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713483176.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
            Source: Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34990000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34990000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
            Source: Colby Dupe Script.exe, 00000001.00000003.1707821250.0000012E32BDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710769468.0000012E3327A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710370689.0000012E32BDC000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711978527.0000012E32BFD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706431007.0000012E3355D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707149366.0000012E32BD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720218950.0000012E3327A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708190498.0000012E33277000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33270000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709567165.0000012E33279000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710735753.0000012E32BFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
            Source: Colby Dupe Script.exe, 00000001.00000002.1718839918.0000012E328E6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709621107.0000012E328E3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1635583610.0000012E32C0C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1635730524.0000012E328AA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707334221.0000012E3288F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708322964.0000012E3289C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
            Source: Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706413891.0000012E33F51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
            Source: Colby Dupe Script.exe, 00000001.00000003.1709621107.0000012E32903000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708135727.0000012E32901000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709678067.0000012E334D2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712112159.0000012E334D5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718948130.0000012E32915000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717086129.0000012E3290E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713650293.0000012E32905000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707334221.0000012E3288F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710527502.0000012E32903000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713100519.0000012E33561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
            Source: Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714916470.0000012E33561000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706431007.0000012E3355D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713100519.0000012E33561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlM
            Source: Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706413891.0000012E33F51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
            Source: Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
            Source: Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706413891.0000012E33F51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlJ
            Source: Colby Dupe Script.exe, 00000001.00000003.1705373771.0000012E33DDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DDD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
            Source: Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715597750.0000012E32CE0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
            Source: Colby Dupe Script.exe, 00000001.00000003.1705373771.0000012E33DDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DDD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlage.alpha_
            Source: Colby Dupe Script.exe, 00000001.00000003.1705373771.0000012E33DDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DDD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
            Source: Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715597750.0000012E32CE0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
            Source: Colby Dupe Script.exe, 00000001.00000003.1705373771.0000012E33DDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DDD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlr
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
            Source: Colby Dupe Script.exe, 00000001.00000003.1708135727.0000012E32901000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719023805.0000012E32937000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707334221.0000012E3288F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708595664.0000012E32936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
            Source: Colby Dupe Script.exe, 00000001.00000003.1709678067.0000012E334D2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712112159.0000012E334D5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
            Source: Colby Dupe Script.exe, 00000001.00000003.1715388690.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705854816.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710461872.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707392854.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712670599.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713483176.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714517499.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716307275.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709338552.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32D08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
            Source: Colby Dupe Script.exe, 00000001.00000003.1714437345.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717384939.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D50000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710945718.0000012E33D3E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
            Source: Colby Dupe Script.exe, 00000001.00000003.1713541464.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710314552.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706027731.0000012E33567000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720717142.0000012E3358B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716103204.0000012E335F9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720805133.0000012E335FB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707807420.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715503146.0000012E3358B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
            Source: Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713974440.0000012E333A6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707732388.0000012E33C8F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722022192.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721154573.0000012E33940000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712904383.0000012E33E65000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34A08000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706975802.0000012E3339D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720679087.0000012E33542000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708412488.0000012E33541000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33381000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713756901.0000012E33C91000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33369000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722349213.0000012E33E94000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715224998.0000012E33C95000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E34640000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E3470C000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
            Source: Colby Dupe Script.exe, 00000001.00000002.1721308720.0000012E33B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
            Source: Colby Dupe Script.exe, 00000001.00000002.1724701056.0000012E34440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
            Source: Colby Dupe Script.exe, 00000001.00000002.1721233798.0000012E33A40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
            Source: Colby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1640772567.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720921669.0000012E33640000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641696445.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33428000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
            Source: Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706027731.0000012E33567000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710065692.0000012E3358E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707807420.0000012E3358A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
            Source: Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
            Source: Colby Dupe Script.exe, 00000001.00000002.1720582325.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711482730.0000012E334A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
            Source: Colby Dupe Script.exe, 00000001.00000003.1713541464.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710314552.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706027731.0000012E33567000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720717142.0000012E3358B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707807420.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715503146.0000012E3358B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
            Source: Colby Dupe Script.exe, 00000001.00000003.1712590285.0000012E33605000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711278766.0000012E33603000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720500434.0000012E3344C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
            Source: Colby Dupe Script.exe, 00000001.00000003.1705333402.0000012E33F21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
            Source: Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
            Source: Colby Dupe Script.exe, 00000001.00000002.1719231230.0000012E32A70000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718495470.0000012E32030000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
            Source: Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711019338.0000012E33CF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
            Source: Colby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1640772567.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641696445.0000012E33412000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/19622133/
            Source: Colby Dupe Script.exe, 00000001.00000003.1711109310.0000012E334A5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711568354.0000012E32C8B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714402222.0000012E32CA3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720600187.0000012E334A6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714239103.0000012E32C9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
            Source: Colby Dupe Script.exe, 00000001.00000002.1725202471.0000012E34ADC000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34990000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
            Source: Colby Dupe Script.exe, 00000001.00000003.1710461872.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713483176.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709338552.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
            Source: Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708582564.0000012E32CA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
            Source: Colby Dupe Script.exe, 00000001.00000003.1705333402.0000012E33F21000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
            Source: Colby Dupe Script.exe, 00000001.00000003.1707821250.0000012E32C0E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719549383.0000012E32C1E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713676718.0000012E32C1E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707109456.0000012E32C0C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708521339.0000012E32C1A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710907105.0000012E32C1C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708168779.0000012E32C17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
            Source: Colby Dupe Script.exe, 00000001.00000003.1707821250.0000012E32C0E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719549383.0000012E32C1E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713676718.0000012E32C1E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707109456.0000012E32C0C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708521339.0000012E32C1A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710907105.0000012E32C1C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708168779.0000012E32C17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl-
            Source: Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
            Source: Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D61000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
            Source: Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
            Source: Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D61000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
            Source: Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
            Source: Colby Dupe Script.exe, 00000001.00000003.1710769468.0000012E3327A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713861342.0000012E33287000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708190498.0000012E33277000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709567165.0000012E33279000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
            Source: Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BAD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
            Source: Colby Dupe Script.exe, 00000001.00000003.1712822913.0000012E33D58000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D59000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710945718.0000012E33D3E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D59000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
            Source: Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34A08000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621133254.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1622333526.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: Colby Dupe Script.exe, 00000001.00000003.1717044109.0000012E33C77000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724346425.0000012E33F4B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721482981.0000012E33C7D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707732388.0000012E33C52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
            Source: Colby Dupe Script.exe, 00000001.00000003.1712590285.0000012E33605000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711278766.0000012E33603000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
            Source: Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BBD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32B9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
            Source: Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BAD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
            Source: Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3345C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716123016.0000012E3347E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720563875.0000012E33480000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
            Source: Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33312000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
            Source: Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711568354.0000012E32C8B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714402222.0000012E32CA3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714239103.0000012E32C9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
            Source: Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713719290.0000012E33DFD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722228943.0000012E33E00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
            Source: Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D61000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
            Source: Colby Dupe Script.exe, 00000001.00000002.1725469599.0000012E34DBC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.orgr
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724701056.0000012E34440000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/icons/958782767255158876/a_0949440b832bda90a3b95dc43feb9fb7.gif?size=4096
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1728863300.00007FFDFFB21000.00000040.00000001.01000000.0000001F.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://codecov.io/gh/pypa/setuptools
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1239953787624488971/a3wwJZwTIyBieIMg9itK_L1J2NSxqLbai8Ke1Wb5FQJB3lE
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/803025117553754132/815945031150993468
            Source: Colby Dupe Script.exe, 00000001.00000003.1640870485.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708292032.0000012E332A0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709000193.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707879900.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710102914.0000012E33261000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1638249488.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711682471.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712573489.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709273413.0000012E33259000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
            Source: Colby Dupe Script.exe, 00000001.00000003.1640870485.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708292032.0000012E332A0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709000193.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707879900.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710102914.0000012E33261000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1638249488.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711682471.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712573489.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709273413.0000012E33259000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
            Source: Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E332E6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710573638.0000012E332AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
            Source: Colby Dupe Script.exe, 00000001.00000003.1709678067.0000012E334D2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712112159.0000012E334DB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334BE000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E3328F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719095820.0000012E32970000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709738285.0000012E334D9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720635274.0000012E334DB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714367312.0000012E334DB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E332E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
            Source: Colby Dupe Script.exe, 00000001.00000002.1721308720.0000012E33B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637097532.0000012E32D18000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
            Source: Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715266041.0000012E33D64000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D68000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D61000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
            Source: Colby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708120917.0000012E3077D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717717838.0000012E30742000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718438971.0000012E30780000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718375557.0000012E30747000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
            Source: Colby Dupe Script.exe, 00000000.00000003.1617846084.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623719184.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627509103.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1623549039.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627641693.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627000502.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627392909.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627751375.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627641693.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1627000502.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1730730722.00007FFE0EB69000.00000004.00000001.01000000.0000000F.sdmp, Colby Dupe Script.exe, 00000001.00000002.1729584611.00007FFE00565000.00000004.00000001.01000000.00000011.sdmp, Colby Dupe Script.exe, 00000001.00000002.1728794504.00007FFDFFB16000.00000004.00000001.01000000.00000033.sdmp, Colby Dupe Script.exe, 00000001.00000002.1730367196.00007FFE0E18A000.00000004.00000001.01000000.00000012.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/black
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719919808.0000012E32E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
            Source: Colby Dupe Script.exe, 00000001.00000002.1719919808.0000012E32E70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packagingn_py
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/discussions
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
            Source: Colby Dupe Script.exe, 00000001.00000002.1719996242.0000012E32F70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/workflows/tests/badge.svg
            Source: Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/wheel
            Source: Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/wheel/issues
            Source: Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32D4D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711682471.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716672726.0000012E332A3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712573489.0000012E332A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
            Source: Colby Dupe Script.exe, 00000001.00000002.1725202471.0000012E34AE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
            Source: Colby Dupe Script.exe, 00000001.00000002.1718495470.0000012E32030000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
            Source: Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713879089.0000012E30728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
            Source: Colby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708120917.0000012E3077D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717717838.0000012E30742000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718438971.0000012E30780000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718375557.0000012E30747000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
            Source: Colby Dupe Script.exe, 00000001.00000003.1708961652.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710011768.0000012E33520000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711245076.0000012E32CA9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714239103.0000012E32CA9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712858183.0000012E33520000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708582564.0000012E32CA8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709547064.0000012E3351D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/requests/toolbelt/issues/75
            Source: Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715597750.0000012E32CE0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/requests/toolbelt/issues/80
            Source: Colby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708120917.0000012E3077D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717717838.0000012E30742000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718438971.0000012E30780000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718375557.0000012E30747000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
            Source: Colby Dupe Script.exe, 00000001.00000002.1721308720.0000012E33B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
            Source: Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710496541.0000012E33457000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720519861.0000012E33457000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705675254.0000012E33456000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
            Source: Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E34640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
            Source: Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E34640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920f4.
            Source: Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
            Source: Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710496541.0000012E33452000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
            Source: Colby Dupe Script.exe, 00000001.00000003.1709567165.0000012E33279000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
            Source: Colby Dupe Script.exe, 00000001.00000003.1704939527.0000012E3294C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715131813.0000012E32953000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715742573.0000012E32955000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
            Source: Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
            Source: Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DB2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
            Source: Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711245076.0000012E32CA9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714239103.0000012E32CA9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709338552.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708582564.0000012E32CA8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710336220.0000012E33DC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/image/png
            Source: Colby Dupe Script.exe, 00000001.00000003.1709547064.0000012E3351D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711886460.0000012E33F0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2022-informational
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/discord/803025117553754132
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/setuptools.svg
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/setuptools.svg
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/readthedocs/setuptools/latest.svg
            Source: Colby Dupe Script.exe, 00000001.00000002.1720735340.0000012E335A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
            Source: Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34990000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/
            Source: Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D92000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706628105.0000012E33DB6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722022192.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645285448.0000012E33D93000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
            Source: Colby Dupe Script.exe, 00000001.00000003.1705854816.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707392854.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712670599.0000012E32D08000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713818381.0000012E32D2A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32D08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
            Source: Colby Dupe Script.exe, 00000001.00000003.1709820076.0000012E3354D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641764648.0000012E33599000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710413986.0000012E3354D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713632426.0000012E3354D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708090019.0000012E33547000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714916470.0000012E3354D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/installing/
            Source: Colby Dupe Script.exe, 00000001.00000002.1720107189.0000012E33140000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719996242.0000012E32F70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools
            Source: Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools/
            Source: Colby Dupe Script.exe, 00000001.00000002.1727473962.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://python.org/dev/peps/pep-0263/
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.js
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsr
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/pypa/setuptools/main/docs/images/banner-640x320.svg
            Source: Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637097532.0000012E32D18000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
            Source: Colby Dupe Script.exe, 00000001.00000003.1710681710.0000012E3326C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708398470.0000012E33268000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720201355.0000012E33274000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714347673.0000012E3326C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708445499.0000012E3326B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714792578.0000012E33274000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/
            Source: Colby Dupe Script.exe, 00000001.00000003.1634706275.0000012E32B95000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718118220.0000012E306A0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634746635.0000012E32BEC000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634639177.0000012E32BEC000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634746635.0000012E32B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
            Source: Colby Dupe Script.exe, 00000001.00000002.1721076607.0000012E33840000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33286000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/stable/history.html
            Source: Colby Dupe Script.exe, 00000001.00000003.1711109310.0000012E334A5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708398470.0000012E33268000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710681710.0000012E33269000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1640870485.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708292032.0000012E332A0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709000193.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707879900.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E3328F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1638249488.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E332E6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710573638.0000012E332AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/github/pypa/setuptools?style=flat
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme
            Source: Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral
            Source: Colby Dupe Script.exe, 00000001.00000002.1725202471.0000012E34ADC000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34990000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://toolbelt.readthedocs.io/
            Source: Colby Dupe Script.exe, 00000001.00000003.1706992150.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711592723.0000012E32C55000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707682903.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
            Source: Colby Dupe Script.exe, 00000001.00000003.1714437345.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717384939.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D50000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710945718.0000012E33D3E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
            Source: Colby Dupe Script.exe, 00000001.00000003.1712822913.0000012E33D58000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D59000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710945718.0000012E33D3E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D59000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
            Source: Colby Dupe Script.exe, 00000001.00000003.1710655680.0000012E328A6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712296481.0000012E328DA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707334221.0000012E3288F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708322964.0000012E3289C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
            Source: Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/P5
            Source: Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E3470C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
            Source: Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wheel.readthedocs.io/
            Source: Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
            Source: Colby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709517694.0000012E30776000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
            Source: Colby Dupe Script.exe, 00000000.00000003.1620113540.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
            Source: Colby Dupe Script.exe, 00000000.00000003.1620113540.000001CB67E97000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1620172956.000001CB67E97000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1620113540.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
            Source: Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E96000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
            Source: Colby Dupe Script.exe, 00000001.00000003.1707187855.0000012E32BB8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719425544.0000012E32BC7000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709445925.0000012E32BB9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710836555.0000012E32BC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
            Source: Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1728579219.00007FFDFF303000.00000004.00000001.01000000.00000015.sdmp, Colby Dupe Script.exe, 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.openssl.org/H
            Source: Colby Dupe Script.exe, 00000001.00000003.1710681710.0000012E3326C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708398470.0000012E33268000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720201355.0000012E33274000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714347673.0000012E3326C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708445499.0000012E3326B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714792578.0000012E33274000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
            Source: Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D92000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706628105.0000012E33DB6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722022192.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645285448.0000012E33D93000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
            Source: Colby Dupe Script.exe, 00000000.00000003.1619232060.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
            Source: Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0427/
            Source: Colby Dupe Script.exe, 00000001.00000002.1718495470.0000012E32030000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
            Source: Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.roblox.com/mobileapi/userinfo
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.roblox.com/mobileapi/userinfor=
            Source: Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
            Source: Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
            Source: Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710496541.0000012E33452000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
            Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F07A9C0_2_00007FF698F07A9C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE7B600_2_00007FF698EE7B60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F06B500_2_00007FF698F06B50
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F017200_2_00007FF698F01720
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF86700_2_00007FF698EF8670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE10000_2_00007FF698EE1000
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EFF3200_2_00007FF698EFF320
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF42D40_2_00007FF698EF42D4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE92D00_2_00007FF698EE92D0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF2A940_2_00007FF698EF2A94
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F017200_2_00007FF698F01720
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF22740_2_00007FF698EF2274
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F04A600_2_00007FF698F04A60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF84BC0_2_00007FF698EF84BC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EFECA00_2_00007FF698EFECA0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF24800_2_00007FF698EF2480
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EFAC500_2_00007FF698EFAC50
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F06DCC0_2_00007FF698F06DCC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE9D9B0_2_00007FF698EE9D9B
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F075500_2_00007FF698F07550
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF35400_2_00007FF698EF3540
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F04EFC0_2_00007FF698F04EFC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF8EF40_2_00007FF698EF8EF4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF3ED00_2_00007FF698EF3ED0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F026C40_2_00007FF698F026C4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF26840_2_00007FF698EF2684
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EFE80C0_2_00007FF698EFE80C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF86700_2_00007FF698EF8670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EEA76D0_2_00007FF698EEA76D
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF67500_2_00007FF698EF6750
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE9F3B0_2_00007FF698EE9F3B
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F0A7D80_2_00007FF698F0A7D8
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF28900_2_00007FF698EF2890
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF20700_2_00007FF698EF2070
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE123401_2_00007FFDFAE12340
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE218801_2_00007FFDFAE21880
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFFBBA01_2_00007FFDFAFFBBA0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFDEC401_2_00007FFDFAFDEC40
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF48AB01_2_00007FFDFAF48AB0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFE3AF01_2_00007FFDFAFE3AF0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFE2B301_2_00007FFDFAFE2B30
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFE79701_2_00007FFDFAFE7970
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF9B9801_2_00007FFDFAF9B980
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFDF9901_2_00007FFDFAFDF990
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF469A21_2_00007FFDFAF469A2
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFA6A001_2_00007FFDFAFA6A00
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF43A501_2_00007FFDFAF43A50
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFC48701_2_00007FFDFAFC4870
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF868801_2_00007FFDFAF86880
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFC58B01_2_00007FFDFAFC58B0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF6B9101_2_00007FFDFAF6B910
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFEEF601_2_00007FFDFAFEEF60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFCB0001_2_00007FFDFAFCB000
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF5B0101_2_00007FFDFAF5B010
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFE60301_2_00007FFDFAFE6030
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF4E0401_2_00007FFDFAF4E040
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF81E601_2_00007FFDFAF81E60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF9FEA01_2_00007FFDFAF9FEA0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF8BEC01_2_00007FFDFAF8BEC0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF43F101_2_00007FFDFAF43F10
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF5FF201_2_00007FFDFAF5FF20
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF54F201_2_00007FFDFAF54F20
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFABD601_2_00007FFDFAFABD60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF9DD601_2_00007FFDFAF9DD60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFB6D701_2_00007FFDFAFB6D70
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFEFD701_2_00007FFDFAFEFD70
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFB7D801_2_00007FFDFAFB7D80
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFDDE301_2_00007FFDFAFDDE30
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFAEE501_2_00007FFDFAFAEE50
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF96C701_2_00007FFDFAF96C70
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFECC701_2_00007FFDFAFECC70
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF51CB01_2_00007FFDFAF51CB0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF8CCF01_2_00007FFDFAF8CCF0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFBED101_2_00007FFDFAFBED10
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFDFD101_2_00007FFDFAFDFD10
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF87D401_2_00007FFDFAF87D40
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF4F4001_2_00007FFDFAF4F400
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFE94401_2_00007FFDFAFE9440
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF842701_2_00007FFDFAF84270
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF622801_2_00007FFDFAF62280
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF582901_2_00007FFDFAF58290
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF972C01_2_00007FFDFAF972C0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF8B3001_2_00007FFDFAF8B300
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFF13401_2_00007FFDFAFF1340
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF981A01_2_00007FFDFAF981A0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF460601_2_00007FFDFAF46060
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF4A0601_2_00007FFDFAF4A060
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFC40601_2_00007FFDFAFC4060
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFD10701_2_00007FFDFAFD1070
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF670B01_2_00007FFDFAF670B0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF6B1501_2_00007FFDFAF6B150
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF6A7701_2_00007FFDFAF6A770
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF5A7B01_2_00007FFDFAF5A7B0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF658001_2_00007FFDFAF65800
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF648101_2_00007FFDFAF64810
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFEA8501_2_00007FFDFAFEA850
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFC76601_2_00007FFDFAFC7660
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF6C6901_2_00007FFDFAF6C690
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF5B6B01_2_00007FFDFAF5B6B0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF8C6E01_2_00007FFDFAF8C6E0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF6E7101_2_00007FFDFAF6E710
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF567401_2_00007FFDFAF56740
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF427581_2_00007FFDFAF42758
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFF05A01_2_00007FFDFAFF05A0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFB25D01_2_00007FFDFAFB25D0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF465DB1_2_00007FFDFAF465DB
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFC25E01_2_00007FFDFAFC25E0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFD14601_2_00007FFDFAFD1460
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFA24F01_2_00007FFDFAFA24F0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAFF25001_2_00007FFDFAFF2500
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF735101_2_00007FFDFAF73510
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB4132301_2_00007FFDFB413230
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C30C11_2_00007FFDFB0C30C1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1F7AF01_2_00007FFDFB1F7AF0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB2639D01_2_00007FFDFB2639D0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB277A101_2_00007FFDFB277A10
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C41651_2_00007FFDFB0C4165
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C3FDA1_2_00007FFDFB0C3FDA
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C6A821_2_00007FFDFB0C6A82
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C655A1_2_00007FFDFB0C655A
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C4C371_2_00007FFDFB0C4C37
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0DBF201_2_00007FFDFB0DBF20
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0DBD601_2_00007FFDFB0DBD60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C22891_2_00007FFDFB0C2289
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C27661_2_00007FFDFB0C2766
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1EFE301_2_00007FFDFB1EFE30
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C32E71_2_00007FFDFB0C32E7
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C3B931_2_00007FFDFB0C3B93
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1F73101_2_00007FFDFB1F7310
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C51691_2_00007FFDFB0C5169
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5D851_2_00007FFDFB0C5D85
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C114F1_2_00007FFDFB0C114F
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0EB1C01_2_00007FFDFB0EB1C0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0DF2001_2_00007FFDFB0DF200
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0DF0601_2_00007FFDFB0DF060
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C29CD1_2_00007FFDFB0C29CD
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C6CB71_2_00007FFDFB0C6CB7
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C21B71_2_00007FFDFB0C21B7
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C609B1_2_00007FFDFB0C609B
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C6F231_2_00007FFDFB0C6F23
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB12F7001_2_00007FFDFB12F700
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C22E81_2_00007FFDFB0C22E8
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C70451_2_00007FFDFB0C7045
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1EA11_2_00007FFDFB0C1EA1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB2FF4601_2_00007FFDFB2FF460
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0EB5501_2_00007FFDFB0EB550
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5B0F1_2_00007FFDFB0C5B0F
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1B221_2_00007FFDFB0C1B22
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB262A901_2_00007FFDFB262A90
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C4D041_2_00007FFDFB0C4D04
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1A2B401_2_00007FFDFB1A2B40
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5D9E1_2_00007FFDFB0C5D9E
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C23F11_2_00007FFDFB0C23F1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1FB0201_2_00007FFDFB1FB020
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C6EEC1_2_00007FFDFB0C6EEC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C213F1_2_00007FFDFB0C213F
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0DEF001_2_00007FFDFB0DEF00
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C72C01_2_00007FFDFB0C72C0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C46331_2_00007FFDFB0C4633
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1A4B1_2_00007FFDFB0C1A4B
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C70771_2_00007FFDFB0C7077
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C6FFA1_2_00007FFDFB0C6FFA
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C36931_2_00007FFDFB0C3693
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C34861_2_00007FFDFB0C3486
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1B311_2_00007FFDFB0C1B31
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1F61301_2_00007FFDFB1F6130
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C60D71_2_00007FFDFB0C60D7
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5E201_2_00007FFDFB0C5E20
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1F26701_2_00007FFDFB1F2670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1CC11_2_00007FFDFB0C1CC1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C4E4E1_2_00007FFDFB0C4E4E
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5A601_2_00007FFDFB0C5A60
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C72521_2_00007FFDFB0C7252
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C38321_2_00007FFDFB0C3832
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C35FD1_2_00007FFDFB0C35FD
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1CFD1_2_00007FFDFB0C1CFD
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C59F71_2_00007FFDFB0C59F7
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C3A851_2_00007FFDFB0C3A85
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB2799E01_2_00007FFDFB2799E0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C50AB1_2_00007FFDFB0C50AB
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB2619201_2_00007FFDFB261920
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C47461_2_00007FFDFB0C4746
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C57D11_2_00007FFDFB0C57D1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C378D1_2_00007FFDFB0C378D
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C43591_2_00007FFDFB0C4359
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C73651_2_00007FFDFB0C7365
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C1D831_2_00007FFDFB0C1D83
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB1F5E301_2_00007FFDFB1F5E30
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C266C1_2_00007FFDFB0C266C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C72A71_2_00007FFDFB0C72A7
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C3BA21_2_00007FFDFB0C3BA2
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C29821_2_00007FFDFB0C2982
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C2D0B1_2_00007FFDFB0C2D0B
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C16221_2_00007FFDFB0C1622
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5F0B1_2_00007FFDFB0C5F0B
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C55101_2_00007FFDFB0C5510
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C44C61_2_00007FFDFB0C44C6
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0DD2601_2_00007FFDFB0DD260
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C53A81_2_00007FFDFB0C53A8
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C42871_2_00007FFDFB0C4287
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5BF01_2_00007FFDFB0C5BF0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB2792101_2_00007FFDFB279210
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0E52001_2_00007FFDFB0E5200
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C24B9 appears 63 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C483B appears 95 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C1EF1 appears 947 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FF698EE2B10 appears 47 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C4057 appears 543 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFAF49310 appears 174 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C2A04 appears 87 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C6988 appears 33 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C300D appears 50 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFB0C2734 appears 368 times
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: String function: 00007FFDFAF486B0 appears 120 times
            Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: win32ui.pyd.0.drStatic PE information: Resource name: RT_MENU type: COM executable for DOS
            Source: win32ui.pyd.0.drStatic PE information: Resource name: RT_GROUP_CURSOR type: DOS executable (COM, 0x8C-variant)
            Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: python3.dll.0.drStatic PE information: No import functions for PE file found
            Source: Colby Dupe Script.exe, 00000000.00000003.1618216684.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1617846084.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618083988.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618701164.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1623719184.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes310.dll0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627509103.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1623549039.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom310.dll0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618773341.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627641693.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627000502.000001CB67E96000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1625206313.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618375247.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1619038795.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1622055958.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1625001192.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618452370.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618551428.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627392909.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627751375.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618965478.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618610966.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1623846898.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618153602.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618899172.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627641693.000001CB67E96000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1617973037.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1619109877.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1618831863.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000000.00000003.1627000502.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1728579219.00007FFDFF303000.00000004.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1730730722.00007FFE0EB69000.00000004.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamepywintypes310.dll0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1732588073.00007FFE1338C000.00000004.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1718569021.0000012E32130000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1733023111.00007FFE14647000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1728168378.00007FFDFB8A0000.00000004.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython310.dll. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1731037336.00007FFE10263000.00000004.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1731947201.00007FFE126F3000.00000004.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1729147678.00007FFE004A9000.00000004.00000001.01000000.00000032.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1729926788.00007FFE0CFC3000.00000004.00000001.01000000.0000001B.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1732097360.00007FFE12E1F000.00000004.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1730549840.00007FFE0EB3E000.00000004.00000001.01000000.00000018.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1731446716.00007FFE11ECC000.00000004.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1731610294.00007FFE11EE8000.00000004.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1726679942.00007FFDFAF37000.00000004.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1729584611.00007FFE00565000.00000004.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilenamepythoncom310.dll0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1728794504.00007FFDFFB16000.00000004.00000001.01000000.00000033.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1732383156.00007FFE1320C000.00000004.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1731194432.00007FFE10318000.00000004.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1732227786.00007FFE130C9000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1730367196.00007FFE0E18A000.00000004.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1730202195.00007FFE0E15D000.00000004.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Colby Dupe Script.exe
            Source: Colby Dupe Script.exe, 00000001.00000002.1730885725.00007FFE101E4000.00000004.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs Colby Dupe Script.exe
            Source: sqlite3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9974986001493175
            Source: libcrypto-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
            Source: libssl-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
            Source: python310.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9989695677157001
            Source: pythoncom310.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9899216389728097
            Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9949597928113553
            Source: _ec_ws.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9973796096262058
            Source: _imaging.cp310-win_amd64.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9980095456484641
            Source: _webp.cp310-win_amd64.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9901831268221575
            Source: win32ui.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9930269281914894
            Source: shell.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9900537778253424
            Source: classification engineClassification label: mal68.troj.evad.winEXE@6/108@1/1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE8770 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF698EE8770
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:908:120:WilError_03
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122Jump to behavior
            Source: Colby Dupe Script.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
            Source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
            Source: Colby Dupe Script.exeReversingLabs: Detection: 50%
            Source: Colby Dupe Script.exeVirustotal: Detection: 35%
            Source: Colby Dupe Script.exeString found in binary or memory: set-addPolicy
            Source: Colby Dupe Script.exeString found in binary or memory: id-cmc-addExtensions
            Source: Colby Dupe Script.exeString found in binary or memory: can't send non-None value to a just-started generator
            Source: Colby Dupe Script.exeString found in binary or memory: --help
            Source: Colby Dupe Script.exeString found in binary or memory: --help
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile read: C:\Users\user\Desktop\Colby Dupe Script.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Colby Dupe Script.exe "C:\Users\user\Desktop\Colby Dupe Script.exe"
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess created: C:\Users\user\Desktop\Colby Dupe Script.exe "C:\Users\user\Desktop\Colby Dupe Script.exe"
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess created: C:\Users\user\Desktop\Colby Dupe Script.exe "C:\Users\user\Desktop\Colby Dupe Script.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: libffi-7.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: libcrypto-1_1.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: libssl-1_1.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: sqlite3.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: pdh.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
            Source: Colby Dupe Script.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: Colby Dupe Script.exeStatic file information: File size 27886092 > 1048576
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: Colby Dupe Script.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Colby Dupe Script.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: Colby Dupe Script.exe, 00000001.00000002.1729225966.00007FFE004B1000.00000040.00000001.01000000.00000011.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: Colby Dupe Script.exe
            Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1728246199.00007FFDFF2C6000.00000040.00000001.01000000.00000015.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: Colby Dupe Script.exe, 00000001.00000002.1729061849.00007FFE004A1000.00000040.00000001.01000000.00000032.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: Colby Dupe Script.exe, 00000001.00000002.1729225966.00007FFE004B1000.00000040.00000001.01000000.00000011.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb source: Colby Dupe Script.exe, Colby Dupe Script.exe, 00000001.00000002.1728657653.00007FFDFFAF1000.00000040.00000001.01000000.00000033.sdmp
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: Colby Dupe Script.exe, 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\python3.pdb source: Colby Dupe Script.exe, 00000000.00000003.1622186763.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718569021.0000012E32130000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Colby Dupe Script.exe, 00000000.00000003.1617973037.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732985131.00007FFE14641000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731795476.00007FFE126D1000.00000040.00000001.01000000.00000007.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Colby Dupe Script.exe, 00000000.00000003.1617973037.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732985131.00007FFE14641000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730410375.00007FFE0EB21000.00000040.00000001.01000000.00000018.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: Colby Dupe Script.exe, 00000001.00000002.1732322580.00007FFE13201000.00000040.00000001.01000000.0000000E.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\python310.pdb source: Colby Dupe Script.exe, 00000001.00000002.1727473962.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731982148.00007FFE12E11000.00000040.00000001.01000000.00000017.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730594110.00007FFE0EB41000.00000040.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Colby Dupe Script.exe, 00000000.00000003.1618083988.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732185301.00007FFE130C5000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: Colby Dupe Script.exe, 00000001.00000002.1731264639.00007FFE11EBC000.00000040.00000001.01000000.0000000A.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731264639.00007FFE11EBC000.00000040.00000001.01000000.0000000A.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: Colby Dupe Script.exe, 00000001.00000002.1730245094.00007FFE0E161000.00000040.00000001.01000000.00000012.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: Colby Dupe Script.exe, 00000001.00000002.1732500989.00007FFE13381000.00000040.00000001.01000000.0000000D.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: Colby Dupe Script.exe, 00000001.00000002.1726484532.00007FFDFAF2C000.00000040.00000001.01000000.0000001E.sdmp
            Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: Colby Dupe Script.exe, 00000001.00000002.1728246199.00007FFDFF2C6000.00000040.00000001.01000000.00000015.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730245094.00007FFE0E161000.00000040.00000001.01000000.00000012.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731103648.00007FFE10301000.00000040.00000001.01000000.0000000C.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: Colby Dupe Script.exe, 00000001.00000002.1730106014.00007FFE0E131000.00000040.00000001.01000000.00000013.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: Colby Dupe Script.exe, 00000001.00000002.1730594110.00007FFE0EB41000.00000040.00000001.01000000.0000000F.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: Colby Dupe Script.exe, 00000001.00000002.1731542743.00007FFE11ED1000.00000040.00000001.01000000.00000009.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: Colby Dupe Script.exe, 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Colby Dupe Script.exe, 00000000.00000003.1618083988.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1732185301.00007FFE130C5000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: Colby Dupe Script.exe, 00000001.00000002.1729845180.00007FFE0CFB1000.00000040.00000001.01000000.0000001B.sdmp
            Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: Colby Dupe Script.exe
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32crypt.pdb!! source: Colby Dupe Script.exe, 00000001.00000002.1728657653.00007FFDFFAF1000.00000040.00000001.01000000.00000033.sdmp
            Source: Colby Dupe Script.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: Colby Dupe Script.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: Colby Dupe Script.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: Colby Dupe Script.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: Colby Dupe Script.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: VCRUNTIME140.dll.0.drStatic PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE12340 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,1_2_00007FFDFAE12340
            Source: Colby Dupe Script.exeStatic PE information: section name: _RDATA
            Source: mfc140u.dll.0.drStatic PE information: section name: .didat
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
            Source: libffi-7.dll.0.drStatic PE information: section name: UPX2
            Source: _rust.pyd.0.drStatic PE information: section name: UPX2
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD4AEE push 6FFDC5D5h; iretd 1_2_00007FFDFABD4AF4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD76D3 push 6FFDC5D5h; iretd 1_2_00007FFDFABD76D9
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD7425 push 60F5C5F1h; iretd 1_2_00007FFDFABD742D
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD4640 push 60F5C5F1h; iretd 1_2_00007FFDFABD4648
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD4FEA push 6FFDC5C3h; iretd 1_2_00007FFDFABD4FF0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD4F9E push 6FFDC5CAh; ret 1_2_00007FFDFABD4FA4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD79CF push 6FFDC5C3h; iretd 1_2_00007FFDFABD79D5
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFABD7983 push 6FFDC5CAh; ret 1_2_00007FFDFABD7989
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE28F53 push r12; iretd 1_2_00007FFDFAE28F6A
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26F54 push r8; ret 1_2_00007FFDFAE26F5C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE2855C push rbp; retf 1_2_00007FFDFAE28575
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26E44 push rdi; iretd 1_2_00007FFDFAE26E46
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26F32 push r12; ret 1_2_00007FFDFAE26F4A
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26C21 push r10; ret 1_2_00007FFDFAE26C23
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE28EFE push r12; ret 1_2_00007FFDFAE28F25
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE29C02 push rsp; retf 1_2_00007FFDFAE29C03
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26CF6 push r12; ret 1_2_00007FFDFAE26CF8
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26DFB push rsp; ret 1_2_00007FFDFAE26E03
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE292E4 push r10; retf 1_2_00007FFDFAE29350
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE2A2E5 push rsp; retf 1_2_00007FFDFAE2A2E6
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26CEA push rdx; ret 1_2_00007FFDFAE26CF1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE277EA push rsi; ret 1_2_00007FFDFAE27821
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26ED0 push r12; ret 1_2_00007FFDFAE26EEE
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26CCC push r8; ret 1_2_00007FFDFAE26CD9
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26EB6 push r10; retf 1_2_00007FFDFAE26EB9
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE291A3 push rdi; iretd 1_2_00007FFDFAE291A5
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE285A7 push r12; ret 1_2_00007FFDFAE285E3
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE2A4A9 push rdx; ret 1_2_00007FFDFAE2A500
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26F8D push r10; ret 1_2_00007FFDFAE26FA0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE26E9B push rsi; ret 1_2_00007FFDFAE26E9C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE29D85 push rsp; iretq 1_2_00007FFDFAE29D86
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\python310.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\libffi-7.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_cffi_backend.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pywintypes310.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pythoncom310.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\libcrypto-1_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\libssl-1_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingmath.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32crypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_webp.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_uuid.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\dd_setup.txtJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE53F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF698EE53F0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C572C rdtsc 1_2_00007FFDFB0C572C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\python310.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_cffi_backend.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pywintypes310.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pythoncom310.dllJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingmath.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32crypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_webp.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_uuid.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59122\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-18183
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeAPI coverage: 2.3 %
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EE8D00 FindFirstFileExW,FindClose,0_2_00007FF698EE8D00
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF698EF8670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F026C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF698F026C4
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EF8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF698EF8670
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C3229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,1_2_00007FFDFB0C3229
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAF4F820 GetSystemInfo,1_2_00007FFDFAF4F820
            Source: Colby Dupe Script.exe, 00000000.00000003.1619718814.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vboxtray
            Source: Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vboxservice
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga
            Source: Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmwareuser
            Source: Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmusrvc
            Source: Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmsrvc
            Source: Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmtoolsd
            Source: Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmwaretray
            Source: Colby Dupe Script.exe, 00000001.00000003.1707187855.0000012E32BB8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719425544.0000012E32BC7000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709445925.0000012E32BB9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710836555.0000012E32BC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWd.
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess information queried: ProcessInformationJump to behavior

            Anti Debugging

            barindex
            Potentially malicious time measurement code found
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C572C1_2_00007FFDFB0C572C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C572C rdtsc 1_2_00007FFDFB0C572C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EFB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF698EFB3CC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE12340 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,1_2_00007FFDFAE12340
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F042D0 GetProcessHeap,0_2_00007FF698F042D0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EECA9C SetUnhandledExceptionFilter,0_2_00007FF698EECA9C
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EFB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF698EFB3CC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EEC030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF698EEC030
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EEC8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF698EEC8BC
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFAE23048 IsProcessorFeaturePresent,00007FFE146319C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE146319C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFAE23048
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C5A1F IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFB0C5A1F
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess created: C:\Users\user\Desktop\Colby Dupe Script.exe "C:\Users\user\Desktop\Colby Dupe Script.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F0A620 cpuid 0_2_00007FF698F0A620
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\PIL VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\certifi VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_lzma.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\python3.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_cffi_backend.cp310-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_decimal.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_hashlib.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_multiprocessing.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_overlapped.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_sqlite3.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_ssl.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_uuid.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pyexpat.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pywintypes310.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pythoncom310.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32api.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59122 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeQueries volume information: C:\Users\user\Desktop\Colby Dupe Script.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698EEC7A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF698EEC7A0
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 0_2_00007FF698F06B50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF698F06B50
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected Luna Logger
            Source: Yara matchFile source: 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1707046871.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706862797.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.1720480190.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1709214739.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Colby Dupe Script.exe PID: 7052, type: MEMORYSTR
            Source: Yara matchFile source: 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1707046871.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706862797.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.1720480190.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1709214739.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Colby Dupe Script.exe PID: 7052, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Luna Logger
            Source: Yara matchFile source: 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1707046871.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706862797.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.1720480190.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1709214739.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Colby Dupe Script.exe PID: 7052, type: MEMORYSTR
            Source: C:\Users\user\Desktop\Colby Dupe Script.exeCode function: 1_2_00007FFDFB0C2B5D bind,WSAGetLastError,1_2_00007FFDFB0C2B5D

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
            Command and Scripting Interpreter            		1
            DLL Side-Loading            		11
            Process Injection            		11
            Process Injection            		OS Credential Dumping2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		12
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts2
            Native API            		Boot or Logon Initialization Scripts1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory31
            Security Software Discovery            		Remote Desktop ProtocolData from Removable Media1
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)21
            Obfuscated Files or Information            		Security Account Manager1
            Process Discovery            		SMB/Windows Admin SharesData from Network Shared Drive2
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
            Software Packing            		NTDS1
            System Network Configuration Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Timestomp            		LSA Secrets1
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading            		Cached Domain Credentials24
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Colby Dupe Script.exe50%ReversingLabsWin64.Trojan.Generic
            Colby Dupe Script.exe36%VirustotalBrowse

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_ARC4.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_Salsa20.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_chacha20.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_pkcs1_decode.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aesni.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_arc2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_blowfish.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cast.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cbc.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cfb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ctr.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des3.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ecb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ocb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ofb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2b.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2s.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD4.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD5.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_RIPEMD160.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA1.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA224.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA256.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA384.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA512.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_clmul.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_portable.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_keccak.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_poly1305.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Math\_modexp.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Protocol\_scrypt.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ec_ws.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed25519.pyd0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            api.ipify.org1%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://crl.dhimyotis.com/certignarootca.crl00%URL Reputationsafe
            http://crl.dhimyotis.com/certignarootca.crl0%URL Reputationsafe
            https://wwww.certigna.fr/autorites/0m0%URL Reputationsafe
            https://www.apache.org/licenses/0%URL Reputationsafe
            http://docs.python.org/library/unittest.html0%Avira URL Cloudsafe
            http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%URL Reputationsafe
            https://github.com/giampaolo/psutil/issues/875.0%Avira URL Cloudsafe
            https://img.shields.io/pypi/pyversions/setuptools.svg0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsr100%Avira URL Cloudmalware
            https://img.shields.io/pypi/v/setuptools.svg0%Avira URL Cloudsafe
            http://crl.securetrust.com/STCA.crl0%URL Reputationsafe
            http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt00%URL Reputationsafe
            http://www.accv.es000%URL Reputationsafe
            http://crl.securetrust.com/SGCA.crl00%URL Reputationsafe
            http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
            http://www.quovadisglobal.com/cps00%URL Reputationsafe
            https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#0%Avira URL Cloudsafe
            https://python.org/dev/peps/pep-0263/0%Avira URL Cloudsafe
            https://api.ipify.org/0%URL Reputationsafe
            http://ocsp.accv.es00%URL Reputationsafe
            http://www.quovadisglobal.com/cps0%URL Reputationsafe
            https://www.openssl.org/H0%URL Reputationsafe
            https://wheel.readthedocs.io/en/stable/news.html0%Avira URL Cloudsafe
            http://goo.gl/zeJZl.0%Avira URL Cloudsafe
            https://wheel.readthedocs.io/en/stable/news.html0%VirustotalBrowse
            https://img.shields.io/pypi/v/setuptools.svg0%VirustotalBrowse
            https://www.apache.org/licenses/LICENSE-2.00%VirustotalBrowse
            https://www.apache.org/licenses/LICENSE-2.00%Avira URL Cloudsafe
            https://python.org/dev/peps/pep-0263/0%VirustotalBrowse
            https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white0%Avira URL Cloudsafe
            https://github.com/pypa/packaging0%Avira URL Cloudsafe
            https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#0%VirustotalBrowse
            http://crl.dhimyotis.com/certignarootca.crlJ0%Avira URL Cloudsafe
            http://goo.gl/zeJZl.0%VirustotalBrowse
            https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsr4%VirustotalBrowse
            https://refspecs.linuxfoundation.org/elf/gabi40%Avira URL Cloudsafe
            https://github.com/giampaolo/psutil/issues/875.0%VirustotalBrowse
            https://github.com/pypa/packaging0%VirustotalBrowse
            https://pypi.org/project/setuptools0%Avira URL Cloudsafe
            https://github.com/pypa/setuptools/workflows/tests/badge.svg0%Avira URL Cloudsafe
            http://crl.dhimyotis.com/certignarootca.crlJ0%VirustotalBrowse
            https://img.shields.io/pypi/pyversions/setuptools.svg0%VirustotalBrowse
            https://refspecs.linuxfoundation.org/elf/gabi40%VirustotalBrowse
            https://discord.com/api/v9/users/0%Avira URL Cloudsafe
            http://docs.python.org/library/unittest.html0%VirustotalBrowse
            https://github.com/urllib3/urllib3/issues/2192#issuecomment-8218329630%Avira URL Cloudsafe
            https://blog.jaraco.com/skeleton0%Avira URL Cloudsafe
            https://tools.ietf.org/html/rfc36100%Avira URL Cloudsafe
            https://pypi.org/project/setuptools0%VirustotalBrowse
            http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode0%Avira URL Cloudsafe
            https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md0%Avira URL Cloudsafe
            https://github.com/pypa/setuptools/workflows/tests/badge.svg0%VirustotalBrowse
            https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white0%VirustotalBrowse
            https://discord.com/api/v9/users/0%VirustotalBrowse
            https://blog.jaraco.com/skeleton0%VirustotalBrowse
            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy0%Avira URL Cloudsafe
            https://tools.ietf.org/html/rfc36100%VirustotalBrowse
            https://github.com/pypa/wheel0%Avira URL Cloudsafe
            https://www.python.org/dev/peps/pep-0427/0%Avira URL Cloudsafe
            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader0%Avira URL Cloudsafe
            http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode0%VirustotalBrowse
            http://mail.python.org/pipermail/python-dev/2012-June/120787.html.0%Avira URL Cloudsafe
            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy0%VirustotalBrowse
            https://httpbin.org/0%Avira URL Cloudsafe
            https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main0%Avira URL Cloudsafe
            https://www.python.org/dev/peps/pep-0427/0%VirustotalBrowse
            https://github.com/pypa/wheel0%VirustotalBrowse
            http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5350%Avira URL Cloudsafe
            https://cryptography.io/en/latest/installation/0%Avira URL Cloudsafe
            http://mail.python.org/pipermail/python-dev/2012-June/120787.html.0%VirustotalBrowse
            https://httpbin.org/1%VirustotalBrowse
            https://github.com/urllib3/urllib3/issues/2192#issuecomment-8218329630%VirustotalBrowse
            https://httpbin.org/image/png0%Avira URL Cloudsafe
            https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md0%VirustotalBrowse
            https://github.com/pypa/setuptools/issues/417#issuecomment-3922984010%Avira URL Cloudsafe
            https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main0%VirustotalBrowse
            https://wiki.debian.org/XDGBaseDirectorySpecification#state0%Avira URL Cloudsafe
            http://tools.ietf.org/html/rfc6125#section-6.4.30%Avira URL Cloudsafe
            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader0%VirustotalBrowse
            https://cryptography.io/en/latest/installation/0%VirustotalBrowse
            http://www.cert.fnmt.es/dpcs/0%Avira URL Cloudsafe
            https://google.com/mail0%Avira URL Cloudsafe
            http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5350%VirustotalBrowse
            https://github.com/jaraco/jaraco.functools/issues/50%Avira URL Cloudsafe
            http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm0%Avira URL Cloudsafe
            https://httpbin.org/image/png0%VirustotalBrowse
            https://wiki.debian.org/XDGBaseDirectorySpecification#state0%VirustotalBrowse
            http://www.rfc-editor.org/info/rfc72530%Avira URL Cloudsafe
            https://github.com/pyca/cryptography/issues0%Avira URL Cloudsafe
            https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.0%Avira URL Cloudsafe
            https://github.com/jaraco/jaraco.functools/issues/50%VirustotalBrowse
            http://www.cert.fnmt.es/dpcs/0%VirustotalBrowse
            http://tools.ietf.org/html/rfc6125#section-6.4.30%VirustotalBrowse
            https://google.com/mail0%VirustotalBrowse
            http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm0%VirustotalBrowse
            https://packaging.python.org/installing/0%Avira URL Cloudsafe
            https://github.com/pypa/setuptools/issues/417#issuecomment-3922984010%VirustotalBrowse
            https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
            https://cryptography.io/0%Avira URL Cloudsafe
            https://api.ipify.orgr0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            api.ipify.org
            		172.67.74.152
            		truefalseunknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://github.com/giampaolo/psutil/issues/875.Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsrColby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmptrue
            • 4%, Virustotal, Browse
            • Avira URL Cloud: malware
            		unknown
            http://crl.dhimyotis.com/certignarootca.crl0Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://img.shields.io/pypi/pyversions/setuptools.svgColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://img.shields.io/pypi/v/setuptools.svgColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://docs.python.org/library/unittest.htmlColby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706027731.0000012E33567000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710065692.0000012E3358E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707807420.0000012E3358A000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://python.org/dev/peps/pep-0263/Colby Dupe Script.exe, 00000001.00000002.1727473962.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#Colby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708120917.0000012E3077D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717717838.0000012E30742000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718438971.0000012E30780000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718375557.0000012E30747000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://wheel.readthedocs.io/en/stable/news.htmlColby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://goo.gl/zeJZl.Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://www.apache.org/licenses/LICENSE-2.0Colby Dupe Script.exe, 00000000.00000003.1620113540.000001CB67E97000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1620172956.000001CB67E97000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1620113540.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=whiteColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pypa/packagingColby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719919808.0000012E32E70000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://crl.dhimyotis.com/certignarootca.crlJColby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706413891.0000012E33F51000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://refspecs.linuxfoundation.org/elf/gabi4Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637097532.0000012E32D18000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://pypi.org/project/setuptoolsColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pypa/setuptools/workflows/tests/badge.svgColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://discord.com/api/v9/users/Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963Colby Dupe Script.exe, 00000001.00000002.1721308720.0000012E33B40000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://blog.jaraco.com/skeletonColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://tools.ietf.org/html/rfc3610Colby Dupe Script.exe, 00000001.00000003.1714437345.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717384939.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D50000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710945718.0000012E33D3E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://crl.dhimyotis.com/certignarootca.crlColby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706413891.0000012E33F51000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodeColby Dupe Script.exe, 00000001.00000002.1724701056.0000012E34440000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.mdColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyColby Dupe Script.exe, 00000001.00000002.1724920395.0000012E3470C000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://wwww.certigna.fr/autorites/0mColby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://github.com/pypa/wheelColby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://www.python.org/dev/peps/pep-0427/Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerColby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708120917.0000012E3077D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1717717838.0000012E30742000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718438971.0000012E30780000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1718375557.0000012E30747000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://mail.python.org/pipermail/python-dev/2012-June/120787.html.Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://httpbin.org/Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://www.apache.org/licenses/Colby Dupe Script.exe, 00000000.00000003.1620113540.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=mainColby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlColby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BAD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BBD000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535Colby Dupe Script.exe, 00000001.00000003.1712590285.0000012E33605000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711278766.0000012E33603000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720500434.0000012E3344C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://cryptography.io/en/latest/installation/Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://httpbin.org/image/pngColby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711245076.0000012E32CA9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714239103.0000012E32CA9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709338552.0000012E33DC1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708582564.0000012E32CA8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710336220.0000012E33DC6000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pypa/setuptools/issues/417#issuecomment-392298401Colby Dupe Script.exe, 00000001.00000002.1719996242.0000012E32F70000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://wiki.debian.org/XDGBaseDirectorySpecification#stateColby Dupe Script.exe, 00000001.00000003.1708208043.0000012E30740000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707273712.0000012E30702000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709517694.0000012E30776000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707213340.0000012E30700000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707999724.0000012E30716000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://crl.securetrust.com/STCA.crlColby Dupe Script.exe, 00000001.00000003.1705373771.0000012E33DDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DDD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33DD1000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0Colby Dupe Script.exe, 00000001.00000003.1705333402.0000012E33F21000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://tools.ietf.org/html/rfc6125#section-6.4.3Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://www.cert.fnmt.es/dpcs/Colby Dupe Script.exe, 00000001.00000003.1710769468.0000012E3327A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713861342.0000012E33287000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708190498.0000012E33277000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709567165.0000012E33279000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://google.com/mailColby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710496541.0000012E33452000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/jaraco/jaraco.functools/issues/5Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://www.accv.es00Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721842223.0000012E33D61000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmColby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BAD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BBD000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://www.rfc-editor.org/info/rfc7253Colby Dupe Script.exe, 00000001.00000003.1706391727.0000012E32C86000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711568354.0000012E32C8B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714402222.0000012E32CA3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32C51000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714239103.0000012E32C9E000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pyca/cryptography/issuesColby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710496541.0000012E33457000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720519861.0000012E33457000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705675254.0000012E33456000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D51000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://packaging.python.org/installing/Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://mahler:8092/site-updates.pyColby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D92000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706628105.0000012E33DB6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722022192.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645285448.0000012E33D93000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DB2000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://cryptography.io/Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://api.ipify.orgrColby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.firmaprofesional.com/cps0Colby Dupe Script.exe, 00000001.00000003.1717044109.0000012E33C77000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724346425.0000012E33F4B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706202806.0000012E33F43000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705307571.0000012E33F40000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1721482981.0000012E33C7D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707732388.0000012E33C52000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referralColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://docs.python.org/3/library/re.html#re.subColby Dupe Script.exe, 00000001.00000003.1709678067.0000012E334D2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712112159.0000012E334DB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334BE000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E3328F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719095820.0000012E32970000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709738285.0000012E334D9000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720635274.0000012E334DB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714367312.0000012E334DB000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637239907.0000012E332E6000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/urllib3/urllib3/issues/2920Colby Dupe Script.exe, 00000001.00000002.1724920395.0000012E34640000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://crl.securetrust.com/SGCA.crl0Colby Dupe Script.exe, 00000001.00000003.1708646545.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715597750.0000012E32CE0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709973632.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715150228.0000012E32CD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707654708.0000012E32CD1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714073811.0000012E32CD5000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2Colby Dupe Script.exe, 00000001.00000002.1721076607.0000012E33840000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33286000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://crl.thawte.com/ThawteTimestampingCA.crl0Colby Dupe Script.exe, 00000000.00000003.1621732137.000001CB67E89000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.quovadisglobal.com/cps0Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33312000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://github.com/pyparsing/pyparsing/wikiColby Dupe Script.exe, 00000001.00000003.1705166363.0000012E32D4D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711682471.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716672726.0000012E332A3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712573489.0000012E332A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://cryptography.io/en/latest/changelog/Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://img.shields.io/badge/code%20style-black-000000.svgColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://setuptools.pypa.io/en/stable/history.htmlColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.iana.org/time-zones/repository/tz-link.htmlColby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32BBD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1634970702.0000012E32B9A000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://mail.python.org/mailman/listinfo/cryptography-devColby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://docs.python.org/library/itertools.html#recipesColby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1640772567.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720921669.0000012E33640000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641696445.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33428000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://api.ipify.org/Colby Dupe Script.exe, 00000001.00000002.1725469599.0000012E34DBC000.00000004.00001000.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaColby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1637097532.0000012E32D18000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://pypi.org/project/setuptools/Colby Dupe Script.exe, 00000000.00000003.1626504632.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://packaging.python.org/en/latest/specifications/declaring-project-metadata/Colby Dupe Script.exe, 00000001.00000003.1709820076.0000012E3354D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641764648.0000012E33599000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710413986.0000012E3354D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713632426.0000012E3354D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708090019.0000012E33547000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1714916470.0000012E3354D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pypa/setuptools/issues/1024.Colby Dupe Script.exe, 00000001.00000002.1720999127.0000012E33740000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/Colby Dupe Script.exe, 00000001.00000003.1707821250.0000012E32BDA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710769468.0000012E3327A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710370689.0000012E32BDC000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711978527.0000012E32BFD000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706431007.0000012E3355D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707149366.0000012E32BD8000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720218950.0000012E3327A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708190498.0000012E33277000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1639918901.0000012E33270000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709567165.0000012E33279000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710735753.0000012E32BFA000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://cdn.discordapp.com/icons/958782767255158876/a_0949440b832bda90a3b95dc43feb9fb7.gif?size=4096Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724701056.0000012E34440000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://img.shields.io/discord/803025117553754132Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://ocsp.accv.es0Colby Dupe Script.exe, 00000001.00000003.1704457723.0000012E33DE1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705955374.0000012E33DF2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722189174.0000012E33DFB000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://www.python.org/Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D92000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706628105.0000012E33DB6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1722022192.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645285448.0000012E33D93000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704775210.0000012E33D9B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706562972.0000012E33DB2000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://www.python.org/dev/peps/pep-0205/Colby Dupe Script.exe, 00000000.00000003.1619232060.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1719844582.0000012E32D70000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://twitter.com/Colby Dupe Script.exe, 00000001.00000003.1710655680.0000012E328A6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709463462.0000012E33D5D000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1645179843.0000012E33D5F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712296481.0000012E328DA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712784057.0000012E33D60000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707334221.0000012E3288F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708322964.0000012E3289C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708033815.0000012E33D5A000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://stackoverflow.com/questions/4457745#4457745.Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://docs.python.org/3/library/pprint.html#pprint.pprintColby Dupe Script.exe, 00000001.00000003.1640870485.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708292032.0000012E332A0000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709000193.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334A2000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707879900.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710102914.0000012E33261000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1638249488.0000012E33298000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1711682471.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1712573489.0000012E332A1000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709273413.0000012E33259000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1641308670.0000012E334B7000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://setuptools.pypa.io/Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.quovadisglobal.com/cpsColby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3345C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E33449000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1716123016.0000012E3347E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720563875.0000012E33480000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://discord.com/channels/803025117553754132/815945031150993468Colby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://google.com/mail/Colby Dupe Script.exe, 00000001.00000003.1709567165.0000012E33279000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://img.shields.io/pypi/v/cryptography.svgColby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://google.com/mail/Colby Dupe Script.exe, 00000001.00000003.1713541464.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704537151.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710314552.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706027731.0000012E33567000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1720717142.0000012E3358B000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1705547606.0000012E3351C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707807420.0000012E3358A000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715503146.0000012E3358B000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://raw.githubusercontent.com/Smug246/luna-injection/main/obfuscated-injection.jsColby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: malware
            		unknown
            https://tools.ietf.org/html/rfc5297Colby Dupe Script.exe, 00000001.00000003.1712822913.0000012E33D58000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715667576.0000012E33D59000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1710945718.0000012E33D3E000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1713561629.0000012E33D59000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://tidelift.com/badges/github/pypa/setuptools?style=flatColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://www.openssl.org/HColby Dupe Script.exe, 00000000.00000003.1621851828.000001CB67E89000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1728579219.00007FFDFF303000.00000004.00000001.01000000.00000015.sdmp, Colby Dupe Script.exe, 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://img.shields.io/readthedocs/setuptools/latest.svgColby Dupe Script.exe, 00000000.00000003.1624359795.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://code.activestate.com/recipes/577916/Colby Dupe Script.exe, 00000001.00000002.1718839918.0000012E328E6000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709621107.0000012E328E3000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1635583610.0000012E32C0C000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1635730524.0000012E328AA000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1707334221.0000012E3288F000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708322964.0000012E3289C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://cdn.discordapp.com/avatars/Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://cryptography.ioColby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://toolbelt.readthedocs.io/Colby Dupe Script.exe, 00000001.00000002.1725202471.0000012E34ADC000.00000004.00001000.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000002.1725090024.0000012E34990000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://www.roblox.com/mobileapi/userinfor=Colby Dupe Script.exe, 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Colby Dupe Script.exe, 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://pypi.org/project/cryptography/Colby Dupe Script.exe, 00000000.00000003.1620256650.000001CB67E8C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            172.67.74.152
            		api.ipify.orgUnited States
            		13335CLOUDFLARENETUSfalse

            General Information

            Joe Sandbox version:40.0.0 Tourmaline
            Analysis ID:1441703
            Start date and time:2024-05-15 02:24:08 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 6m 39s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:4
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:Colby Dupe Script.exe
            Detection:MAL
            Classification:mal68.troj.evad.winEXE@6/108@1/1
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:
            • Successful, ratio: 70%
            • Number of executed functions: 48
            • Number of non-executed functions: 124
            Cookbook Comments:
            • Found application associated with file extension: .exe
            • Stop behavior analysis, all processes terminated

            Warnings

            • Excluded IPs from analysis (whitelisted): 20.12.23.50
            • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, ctldl.windowsupdate.com, glb.sls.prod.dcat.dsp.trafficmanager.net
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
            • Report size getting too big, too many NtSetInformationFile calls found.

            Simulations

            Behavior and APIs

            ⊘No simulations

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            172.67.74.152stub.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/
            stub.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/
            Sonic-Glyder.exeGet hashmaliciousStealitBrowse
            • api.ipify.org/?format=json
            Sky-Beta.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/?format=json
            Sky-Beta.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/?format=json
            Sky-Beta-Setup.exeGet hashmaliciousStealitBrowse
            • api.ipify.org/?format=json
            Sky-Beta.exeGet hashmaliciousStealitBrowse
            • api.ipify.org/?format=json
            SongOfVikings.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/?format=json
            SongOfVikings.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/?format=json
            Sky-Beta Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
            • api.ipify.org/?format=json

            Domains

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            api.ipify.orgNew Order n. 4533452041, date 14.05.2024.htaGet hashmaliciousAgentTesla, GuLoaderBrowse
            • 104.26.12.205
            CHNSoT10HG.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
            • 104.26.12.205
            SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.13253.12913.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
            • 104.26.13.205
            935-24Aski.htaGet hashmaliciousAgentTesla, GuLoaderBrowse
            • 104.26.12.205
            25094.xlsGet hashmaliciousAgentTesla, PureLog StealerBrowse
            • 104.26.13.205
            POP.exeGet hashmaliciousGuLoaderBrowse
            • 104.26.13.205
            4jCkCt5XGE.exeGet hashmaliciousAgentTeslaBrowse
            • 104.26.12.205
            LPP Loading Advice Poland ETD 08-May.xlsx.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
            • 104.26.12.205
            NOA, BL and invoice.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
            • 172.67.74.152
            PO# CB20240022.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
            • 104.26.12.205

            ASNs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            CLOUDFLARENETUShttps://www.glwkce.shop/Get hashmaliciousUnknownBrowse
            • 1.1.1.1
            SecuriteInfo.com.Win32.SpywareX-gen.6594.13084.exeGet hashmaliciousLummaCBrowse
            • 104.21.54.246
            https://dhltarcking.sviluppo.host/RDGDESDZRFSYJNOI/index.php?FGDD=1Get hashmaliciousHTMLPhisherBrowse
            • 104.17.25.14
            messages undelivered.htm_Get hashmaliciousHTMLPhisherBrowse
            • 104.21.84.200
            https://biggesttubesite.z13.web.core.windows.net/index.htmlGet hashmaliciousTechSupportScamBrowse
            • 104.18.10.207
            https://sharepoint-0a17.dideto2686.workers.dev/Get hashmaliciousHTMLPhisherBrowse
            • 104.17.25.14
            SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
            • 104.18.21.226
            https://www.knxzovc.asso.ci/Get hashmaliciousUnknownBrowse
            • 1.1.1.1
            SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
            • 104.18.20.226
            http://www.tinyurl.com/gamks929sk?pt3kt2YdFUY0XQQZU7seiJ2ZpJZPTXB02_WZcOJZXZlbHluQG5hbGV6eXR5LmNvbcOIPh9QAwFRcL3LXbxrhpGIqUzwaVwGet hashmaliciousUnknownBrowse
            • 172.67.197.117

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_chacha20.pydSecuriteInfo.com.Win64.Evo-gen.1340.7200.exeGet hashmaliciousLuna LoggerBrowse
              SecuriteInfo.com.Win64.Evo-gen.19254.19116.exeGet hashmaliciousLuna LoggerBrowse
                Splunk_Grabber.exeGet hashmaliciousUnknownBrowse
                  C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_Salsa20.pydSecuriteInfo.com.Win64.Evo-gen.1340.7200.exeGet hashmaliciousLuna LoggerBrowse
                    SecuriteInfo.com.Win64.Evo-gen.19254.19116.exeGet hashmaliciousLuna LoggerBrowse
                      Splunk_Grabber.exeGet hashmaliciousUnknownBrowse
                        C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_ARC4.pydSecuriteInfo.com.Win64.Evo-gen.1340.7200.exeGet hashmaliciousLuna LoggerBrowse
                          SecuriteInfo.com.Win64.Evo-gen.19254.19116.exeGet hashmaliciousLuna LoggerBrowse
                            Splunk_Grabber.exeGet hashmaliciousUnknownBrowse

                              Created / dropped Files

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_ARC4.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):9728
                              Entropy (8bit):6.784099973801211
                              Encrypted:false
                              SSDEEP:192:Dz1519kKsPOR3popHp88o6UPmP2TINjzAN3DekYj273QJXpHM:Dz157kKsWR3puHp7o6mmP28tzAxeZa7p
                              MD5:79CB88FD8430233F7A1016156F30CDC0
                              SHA1:711180549115DBEB465E4BA5FD6469A9495013DD
                              SHA-256:6FA90105B62E529AE76377B5E1BD182A8575B33DA8221041CB1D74B12FFF05EB
                              SHA-512:0E35A951C7130EBDEE973E2FEA09212CCE8884D959269F9B3382B5AE091779104596EE2003B057C8856704EEF68CD75EB2358A6F89F46BCC4442AF4D10197D6B
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Joe Sandbox View:
                              • Filename: SecuriteInfo.com.Win64.Evo-gen.1340.7200.exe, Detection: malicious, Browse
                              • Filename: SecuriteInfo.com.Win64.Evo-gen.19254.19116.exe, Detection: malicious, Browse
                              • Filename: Splunk_Grabber.exe, Detection: malicious, Browse
                              Reputation:low
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...O..e.........." ...%. .......p........................................................`.........................................L..........\............@........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_Salsa20.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10752
                              Entropy (8bit):6.868813059433361
                              Encrypted:false
                              SSDEEP:192:Sy6LLPGQXSBqwVnSxrDZ6Wa9kYj273QJXhnDhny:X6L7G4SBfi6Wa9Za7gJXhE
                              MD5:067672B26A276933CA266A4905411177
                              SHA1:D0956DE75607E58C2456D1B0D65CA618A5DE3E32
                              SHA-256:D0A372A717C35ED589FE00A93A182DE8C60F4284EA1174F80EEDFA61F073387E
                              SHA-512:8C3EC1162CD2AFFA72A406FF4B09B15167CCE424C854F0132C91A3E60DF0E8C6702C27E541D33A6DF2D1475414160B0D6EC1F91517186192A586F22A49401449
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Joe Sandbox View:
                              • Filename: SecuriteInfo.com.Win64.Evo-gen.1340.7200.exe, Detection: malicious, Browse
                              • Filename: SecuriteInfo.com.Win64.Evo-gen.19254.19116.exe, Detection: malicious, Browse
                              • Filename: Splunk_Grabber.exe, Detection: malicious, Browse
                              Reputation:low
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%.0.......p..P.....................................................`.........................................L..........\............P..L...............$...................................P...@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_chacha20.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11264
                              Entropy (8bit):6.901227659425816
                              Encrypted:false
                              SSDEEP:192:Yrp6LLPGQXSPkf1KDXH3z1O/yMJkYj273QJXbnGHdN9lk:G6L7G4S8d6H3+JZa7gJXi9N9
                              MD5:B373B105751E4EB54D7BED60ABF38772
                              SHA1:F06B3E656C4BFA9641B70BA1843A96DFCFDF26FF
                              SHA-256:7E1066DEFB01B427EBA03C04159FBBA281BB2440AB622FECC408F9725E0FFC70
                              SHA-512:C8BAA4B0523DAD655635DC3334C5DC3BB6C6250E4E26315C93E8DCA83ED155C1101751DE036E7B7CBEE787435FC0E736B9EED99E5C037EF60FDECFB50B8CF816
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Joe Sandbox View:
                              • Filename: SecuriteInfo.com.Win64.Evo-gen.1340.7200.exe, Detection: malicious, Browse
                              • Filename: SecuriteInfo.com.Win64.Evo-gen.19254.19116.exe, Detection: malicious, Browse
                              • Filename: Splunk_Grabber.exe, Detection: malicious, Browse
                              Reputation:low
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%.0.......p........................................................`.........................................L..........\............P..d.......................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_pkcs1_decode.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11264
                              Entropy (8bit):6.921268073528014
                              Encrypted:false
                              SSDEEP:192:1411+odumD23wZjzKFyACX2OaIFpRHJLqqhthgkYj273QJXinCW:/Hp3wFzKFNEpFX9qqhTgZa7gJXr
                              MD5:5A600939BEA7972085FCD1FB8C5AFC4B
                              SHA1:491DEBBA06183ACB66C0A2BDD681F3E094DE9ED6
                              SHA-256:656D8C5869F87D20385CEF4B8C43E5B49A259E57405B7DC3C92037C2E09BB311
                              SHA-512:DC843AB511EE0C762A665EB514B1A7B2635044AC11590F8E941CC6BC44BCAE17C12E4AC8775343AD9EAC2C0A762E2924FAED50BCD44B483DC5F70754BC09FB97
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:low
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d...N..e.........." ...%.0.......p..`.....................................................`.........................................L..........\............P..|..................................................`...@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aes.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):17920
                              Entropy (8bit):7.4817614639653565
                              Encrypted:false
                              SSDEEP:384:Dzc0mElU25IfO5Vha1ALR8Hxy/JgqY1Sa0CyZa7gJXNq:Dz9hlNumYYcFh1f8p9q
                              MD5:AC70E4D67A4B0B12B2ED3272F374D711
                              SHA1:0DC76997EB6BFAD56E8497C30F85F0AEF1D4DDDF
                              SHA-256:4D53D50CACAE3824A82B53C802A376EF17240425F06CBEA00E2783524B89E967
                              SHA-512:EF412BDEE8FF044928DCDF47A01DB68E22C8076BF9EFDE88F789DC328ABA4C5FF19D353B3D49932195642CC2EC4FEC91E50BF8B670A4A9E9D3AB632473E1622A
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:low
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...L..e.........." ...%.@................................................... ............`.........................................L...........\.......................................................................@...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_aesni.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11776
                              Entropy (8bit):6.9281038515383395
                              Encrypted:false
                              SSDEEP:192:Yv1jz8WmvrfVBUmDE9eekugaeD9urEb/ienWUkYj273QJX0nnd:Aza7ie4ublZa7gJXE
                              MD5:17DD2E38FAAB69E6083043712025A48B
                              SHA1:B3BB831CE31FAE52CF73629435FACB420108B599
                              SHA-256:D558E1603DBF729F3742881F5FCA2C54459DB00C90E8034840DC80C430E49017
                              SHA-512:C42C5C0C3DB379CBB9AE48DFA9CC4D13194752E8E8DA3F6A6EDB2CA5EBC3B2C3061EC111B7842819F962A00EAB128B8FFD6AA4B21FD316E56C65D166FC55A902
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d...L..e.........." ...%.0.......p........................................................`.........................................L..........\............P........................................................@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_arc2.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):12288
                              Entropy (8bit):7.216357443903366
                              Encrypted:false
                              SSDEEP:192:/8Ui33HUci0GPIuf1ygBIaIViLYcEdaRwPXY7IGq81UH4kYj273QJXzHj:/8UmXU7ZQuxBkVl1dlPXY0G11o4Za7gJ
                              MD5:B58DB42A88C8990F7A8B4AA53BE1B36B
                              SHA1:2C76D5CD8249671CFDF3A98B6B3C08689262A7A8
                              SHA-256:6C4A39EA9A9E7FA31AE5493D93FB9DAA5CCD55FAB8425FE8B9847330F2AA708B
                              SHA-512:600D202C52D4CCE7F869188CF701B6310EDB0295991B3F8DB6D6CCA8611E991F023C8F6B53FBE9199689A270C31719AD1ABEAE3DFE71EE7640A21EDCA1D40F88
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%.0................................................................`.........................................L...........\............`..........................................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_blowfish.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):15360
                              Entropy (8bit):7.385300209199526
                              Encrypted:false
                              SSDEEP:384:DmMoWcZrqnai5YEpXEHBWbru9tX/SZa7gJXtp:DmMoFrE5OB8r66pd
                              MD5:0DE940D103A8B74532698F86EE910C29
                              SHA1:87F904763D340AFBC8D356B7D24D7B0C5E7BEB3E
                              SHA-256:E85AAE1EE31572630A15370C9412228360BCEAC685D3CEAF96A18F9BC583F1D1
                              SHA-512:D8B8AABA7969F23E6020651E26B62F89A17D20DCC1FCBA06245AB6A74D8C654C6EBE0F48A90E2E4568E8110D70C586326E558733FF1C2C48D14921DB298E96B9
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%.@.......... .....................................................`.........................................L...........\............p...................................................... ...@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cast.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):20480
                              Entropy (8bit):7.602252043128806
                              Encrypted:false
                              SSDEEP:384:JxxaC+SE5wRA5pKl3ScWGGyHgSbwKgCQKgdhAJZa7gJXcI:Z3Eipl3KxaDBpsI
                              MD5:D0B0D6D172EE41D70B0F2CAE5BC5D872
                              SHA1:DE0198E65DE559908FCCCE3C193243F6C13A8415
                              SHA-256:300563C4557D1833B97470BB4A25AA1B502617BC75B9D96A99A9467806F11F8C
                              SHA-512:1C1F5992D7962BB4943E0602FCF53E23E3812F565156DE20E69A7BABEDDFBD1DC55118B0FA29CAD81688FE6AC82753D3A3A2BF8F666660F22DC472D1D1931978
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.P..........P.....................................................`.........................................L...........\...................................................................P...@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cbc.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10240
                              Entropy (8bit):6.848590112788967
                              Encrypted:false
                              SSDEEP:192:56LLPGQXSPRw1RVAIATV7KukYj273QJX93ua:56L7G4SZURV3AMuZa7gJXs
                              MD5:F2BF3F3CDCE0E6A8A29BD7FAD094736B
                              SHA1:7EB4AF31B93EE38219EB31C2A867959BB7A3EC53
                              SHA-256:D8A9EDFF4C8CBBD02CC89541CD1A9F8B1BA8381F000A86F910B4D6831BB9A034
                              SHA-512:EA3DCDD0218F51BEDAFE9FB995D84A820D244673086F42276D7CB6C398C67F0E4F79EC343DD0A6FC0AF03AE605AABBBD93C8C612CBFD7DDF641B9F8A8DB13C83
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...N..e.........." ...%. .......p........................................................`.........................................L..........\............P..X.......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_cfb.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10752
                              Entropy (8bit):6.921521895410943
                              Encrypted:false
                              SSDEEP:192:ClmTnQI5hJ/fzLf2kyPCeN4Czw4v5RTZG9hiAZkYj273QJXhngQ:TnQYZfzByPJ2M/5RVY0AZZa7gJXe
                              MD5:4D651469EFF9F0A3F904FCAC9B1A41D2
                              SHA1:F9EB0D3AE58B8195E2485C6C378CE84F95C9EE54
                              SHA-256:1B835A8C05DCC24C77FCF21AE0091CE34ACA3B6B3D153415E3F0CF0142C53F9B
                              SHA-512:0C10C6A52E2FA9BDF89229AD9964CFFF6F3621EAAD6F3AACEBBBC8DA6FF742E087C79AF2D2D152C433160F25A9E45A2C41E13349CBA758640163832569D37CFD
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...N..e.........." ...%.0.......p........................................................`.........................................L..........\............P..d.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ctr.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11264
                              Entropy (8bit):6.924881224263464
                              Encrypted:false
                              SSDEEP:192:jeAKe/cDRHpPJw3XF3VJtZuykYj273QJX1nmX:jyNReXXJtZuyZa7gJX0
                              MD5:0A47AE20F5C45144EAA5C6AF1BA33757
                              SHA1:DAD050EA948C1E327369A3644C7CC65E7927BF10
                              SHA-256:77D5D375FA405F83FBA90FF51BDA86C2233146A3AA768367F8EF582ABA453AAB
                              SHA-512:A8EB40AE7A390D2D13DEB0DF6E753A3D3FD1F02597271020EE46C1326578908E402F3A527D8BC69FE9638CC1960330C7E81578A3DBDC0E93636B90D506ED5CAE
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d...O..e.........." ...%.0.......p..@.....................................................`.........................................L..........\............P......................................................@...@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):17920
                              Entropy (8bit):7.41383195233212
                              Encrypted:false
                              SSDEEP:384:9RqrotMlaakiQHVzTuyz1axe0ehq3gK59p5qJOIOZa7gJXX:9RqrY0dkiW9Tvz1hEgK572Apn
                              MD5:B74E7AC2309BC4C6780522197605BAFC
                              SHA1:D46FA3D3541EF9E64BEBB653BE5277A440C7C640
                              SHA-256:1132F7F463C4928FB6AC4B77948B478075F2D5DF0FF984406E28412542F240B1
                              SHA-512:5AD648BFE05C9CE06488A287F645833CF8CDC0E02052C6EA07EAB4FED7CFD26CE84182E84409950649B1E68F669406C6E097BB7238DFE76E3365220C464E3761
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...M..e.........." ...%.@...........N... ...................................p............`.........................................Lb.......`..\....`..........l............b.......................................Z..@...........................................UPX0....................................UPX1.....@... ...>..................@....rsrc........`.......B..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_des3.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):17408
                              Entropy (8bit):7.47046946370741
                              Encrypted:false
                              SSDEEP:384:99rotMv4nDzAZ2wg90+Lx0EjhZa7gJXM:99rYYXoLx02pc
                              MD5:7CEFBE1123ED3489A630A7111127D42B
                              SHA1:3B2C7F2881CF80DCE00EEB3322ABDCB32036F15D
                              SHA-256:4D61A89B941D29F9162812F3500D13BCE99C452ABF224E2F720204AD2A7A8F62
                              SHA-512:65FC13560BF492C66240BD0C1FCBB2EA16CD645F90A8369E0444B5E9BB01C92C2E55452E4239FAEC8E6240E6F4AF5881450A56FED4446F57C6F807E81B13BB15
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...N..e.........." ...%.@...........M... ...................................p............`.........................................Lb.......`..\....`.......................b.......................................Y..@...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ecb.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):9216
                              Entropy (8bit):6.796729774507867
                              Encrypted:false
                              SSDEEP:192:g51aJhdZfybbKUtzyPwkYj273QJXpHbH:g5kKbOUtzSwZa7gJXxH
                              MD5:B47C542168546FB875E74E49C84325B6
                              SHA1:2AECAB080CC0507F9380756478EADAD2D3697503
                              SHA-256:55657830C9AB79875AF923B5A92E7EE30E0560AFFC3BAA236C38039B4EF987F2
                              SHA-512:FC25087C859C76DFF1126BBFE956EA6811DC3CA79E9BBFD237893144DB8B7CE3CAE3AEB0923F69E0BFFFA5575B5442AD1891D7088DD3857B62BE12B5326BE50D
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%. .......p........................................................`.................................................................@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_eksblowfish.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):15872
                              Entropy (8bit):7.402716006836691
                              Encrypted:false
                              SSDEEP:384:xmMoWcZrqnyj+h0fvzyWj4vu7or6g7OiPZa7gJXvn:xmMoFrHj1nzy7fX7jpf
                              MD5:9F06168B9D6A2F83D495AE2BE9118EDB
                              SHA1:3E38D6D3A0FDC8E3F2915FA5ED4B546B9CEA451B
                              SHA-256:1F1B0D2274576B2F36E79BC3EBA115C545764B29F37DAD5A2D62A3ADC3049FC1
                              SHA-512:30F23D139C493652AB962C4F4392F092DC376986375921C4D9EA1D338862E1961EBD51E5B5BB22DF0E2F40208D4430A45BEEECF073D28B6C2CF1F447D28921D0
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.@................................................................`.........................................L...........\............p..........................................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ocb.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11776
                              Entropy (8bit):7.032779919711558
                              Encrypted:false
                              SSDEEP:192:Tu3adl/1kJsPVTJIWO75b63Nvpn394yqwKMcL8ekYj273QJXRH7g:eeJIWM16DGtPeeZa7gJXq
                              MD5:4F7465CEDDA4E01BB23EBE95467EFAA7
                              SHA1:BC8153DB28583D45B411E5040FB6B01EE36AF83D
                              SHA-256:2076F5AC5F56C43053CB61750B04933E120902C172053C0432E4686169431DB8
                              SHA-512:B97E1CE4979EC8B4A4ABD32160ABE54BAC08E53E7AAB771F6740A78EEA45DF531E9861EC3A1A4AB8FD1BFA6E28B2E8A933C92C7796FBC9C78D5AD7749B7CF2DB
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...O..e.........." ...%.0..........`.....................................................`.........................................L...........\............`..............H.......................................`...@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Cipher\_raw_ofb.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10240
                              Entropy (8bit):6.729835207850266
                              Encrypted:false
                              SSDEEP:192:C36LLPGQXSPG7xn5yE27OLkYj273QJX93C7:C36L7G4SSx5yEjLZa7gJXI
                              MD5:6315A891EA3F996FC4B5EC384841F10C
                              SHA1:ED76EF57517E35B7B721A8B1A3E1FFA7873AEC57
                              SHA-256:087C238E1AA9038F53F8C92E7255F7ADC9CD9A60A895256962DC39A73D596382
                              SHA-512:083859A84FF84E865CFC255FF1674134940C5A64CC703C4AE7815501D586005B6B6CABC28E52239AE24CD38A1253D634D8DE87D98A4A65F45DF2B34BC24C2483
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...O..e.........." ...%. .......p........................................................`.........................................L..........\............P..X.......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2b.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11776
                              Entropy (8bit):6.9607448530291185
                              Encrypted:false
                              SSDEEP:192:oR6LLPhjAm772BoThOlSC3ObOWkYj273QJX1no9uG:S6L7hjAcNlOv3ObOWZa7gJXas
                              MD5:CEFA1801A2FC186822EE841A360B96BB
                              SHA1:002C7A9E5FCB59F4C5D5A2B122AC8CD7B1A9ECD2
                              SHA-256:8A43F2F47689FC68CBDF07465950FF6571A884292B5014EA0793FFE26C056736
                              SHA-512:3BD76F658C29C016C493359D044260A9EF2541910F17DAF80D7A9F328903E5593D9980E93E1D048138741305DA6D3F93B6C412A22D826C40D75B195A437E8D2C
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%.0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_BLAKE2s.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11264
                              Entropy (8bit):7.135736917919551
                              Encrypted:false
                              SSDEEP:192:ms1UnFmx7ejRs3RtTWxpNoEjvbonw4tUkYj273QJXinPNua:0y7iItixpNpOZUZa7gJX28
                              MD5:526078B253E0BCCD1DA0DEB45DD05C4C
                              SHA1:C43198E7822DEE397B27B20605EA2E78F95E1D41
                              SHA-256:1478F02374BCDDA6B4E736C47501C6AEDCEF273DE84240FF06E1797AA4941E84
                              SHA-512:B91686F08551A13E8F1BA6098D9C7538751FBE29900AFE1233B63BDFB4882A20B3772CF3C284DB5473FBED48AAAC7D7A5641E33F3BB326B3DE56DEB5AB2AF8F4
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%.0.......p........................................................`.........................................L..........\............P..@.......................................................@...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD2.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10752
                              Entropy (8bit):6.937339386902163
                              Encrypted:false
                              SSDEEP:192:vd11+odumD23wZjztFN4pRed/SWdr1ghNtdydkYj273QJXino1wWB:QHp3wFzHYekWRdZa7gJXv11B
                              MD5:84C0EB11ED3BF596E9A42274E0673E07
                              SHA1:7C967D93782E91721566B230C9874E0454C8B264
                              SHA-256:7B236622248990B3A8F8C0A331DD115E2FBFD4245E6006AA36ACA07F7226B248
                              SHA-512:62C91E7EEA0C61B0FB62421AC219246B99660A25410D4D1D286581D688C64E393E7BE028B0D51FFC37668755E99B28449122593F2446DF76DC8D7C9B887CC093
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...A..e.........." ...%.0.......p........................................................`.........................................L..........\............P..(.......................................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD4.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10752
                              Entropy (8bit):7.0093770381138585
                              Encrypted:false
                              SSDEEP:192:lSgknHOazCaUFFeWEeh35+iNu46kYj273QJXbn9nFQ:enHOr1FJhpF046Za7gJX5FQ
                              MD5:6F7EDD258178F5A5E4B84A2D8FE044E1
                              SHA1:6170118D8D9B71DC38CC4BEA17FD33B053B7C277
                              SHA-256:179BE7F1A96C3A05B5A69ACBAF2C0E05DF02D6831E0C63F82B35F22CF43B8EB3
                              SHA-512:05CA5D120A00482E6CB0CD5E1BC1724E0D634DC2D3554F75DE6A48CB9A9EB22F2346B8E6C72767C0DE332C895B61F1B59B34B6BEA6BCD8A63756EF0DA56DB884
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0.......p..p.....................................................`.........................................L..........\............P..(...................................................p...@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_MD5.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):12288
                              Entropy (8bit):7.123762867237682
                              Encrypted:false
                              SSDEEP:192:GI1qextX4NJ31BSsrBgxjLKpXMnnzfXe/0yunwOkYj273QJX0n5AS:IkX4NJlBcNKpcnnEPOZa7gJX2A
                              MD5:B6C328D1BD218F6D79150BAF7AED0622
                              SHA1:E9EE3B8D774140FA7F045A00FE31F8CD9CEB2A46
                              SHA-256:EA347942A8B2BB0780A1A79B5E0E88ABD6D01091EEA07F1D1F5360DD1D5D3640
                              SHA-512:700D3D6EED41792C9220D4C2AEC49992612C30DEBE7A3E3B9AF799A3F83AE7101791A14D80D5952ED0428FD6F38F4B796BFA3423595728F4027B7BD5DBA9BE3F
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0.......p.......................................................`.........................................L..........\............P..X......................................................@...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_RIPEMD160.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):13312
                              Entropy (8bit):7.121350701826669
                              Encrypted:false
                              SSDEEP:192:Z8Ui33nGwqV0n6Vd4C+Am8lDuKL39fZLnDkYj273QJXLH9n:Z8Um2hRVRnm8wGR9DZa7gJXp
                              MD5:94A5E4F70FEB0117893A46945350A48D
                              SHA1:992D6AB95E102431A08B712F576CB87F480D8A46
                              SHA-256:CAEE802F01AF1AF46BF640AFC67C846C492EF2958CFF766AB094410576583C77
                              SHA-512:CF27CDE8B4C372026C53F22065D2DDDE2DEBA2BA0D9FF3CC84283E8AA278C20AF1570E7A5323B50EDF2672B5F4DA78ABA0FA0B04585AB657200C88543FA6AAB0
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%.0...............................................................`.........................................L...........\............`..............$..........................................@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA1.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):13824
                              Entropy (8bit):7.350463408569454
                              Encrypted:false
                              SSDEEP:192:ZU3adl/1kJsPVTJIW70wCkBlMeOuN0NkqJnENdVIJkmSkYj273QJXJ3p8:CeJIW70KBdO/iNz4kmSZa7gJXT
                              MD5:24611153E8F1B08D045209D461A54D42
                              SHA1:9D7D9119F80A0E6DF72B8F55DB638D6107C7AA61
                              SHA-256:D76B2DC836F8EF43EEACC97E799CB1C3A1736A4F26E5C0D1F6C7031BCB06B78E
                              SHA-512:DB3DD23D94C6CA715B3E48BABBA35C16447A843B1F8F17316D340F0903434373BE2FE1B2460A57ACE84802656FCEB6DDAE183B74D62EE1EF9A928D1D2F8EEF70
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0.......p........................................................`.........................................L..........\............`..X...........$...........................................@...........................................UPX0.....p..............................UPX1.....0..........................@....rsrc................2..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA224.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):14848
                              Entropy (8bit):7.310514573337607
                              Encrypted:false
                              SSDEEP:384:JPTn8PuSwRaTYeToRcdZhq8g7LEZa7gJX+:JjEuTaTYeUMhMgpu
                              MD5:BD8C2A8BCEE473703D2EB31635B88472
                              SHA1:E654B2B0639C7F6AB4256A71ACD0C1AF5CF21717
                              SHA-256:F830C7ACFC67080032E36408DA16B4B53DB7EAC8B9B06AC08B7303C1577C99EF
                              SHA-512:73599CC3C34A1CF662A445A17E1A1FAF65A128F04CA6F824C76D0BF0B53C3B352AC617B8F15605F2269B2342B46FA990618B1B7913E747A4802F412E889CF3AD
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...F..e.........." ...%.@................................................................`.........................................L...........\............p..............4...$.......................................@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA256.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):14848
                              Entropy (8bit):7.311541149215987
                              Encrypted:false
                              SSDEEP:384:NPTn8PuSw6yjFCbg7ruFSH3+xEZa7gJX+:NjEuDjMbciAXnpu
                              MD5:012DB77EC11F1E7EB110AD0520670783
                              SHA1:E2F18479A8178953E55C75BB001FF9EE870E8B06
                              SHA-256:A9FA44A1B9BA35A463B5A2F6A8E124EA66AD54745759876B732989E188BFF7C9
                              SHA-512:FAA4A0AA5A66F2D85812D991B6ED3C0C303309DC6A8E61379301884F4D9437C9A42DB4113B4A50FFB1D7A677242FA4A635617ED38DFB8F285FE49ECB78A11599
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...D..e.........." ...%.@................................................................`.........................................L...........\............p..............4...$.......................................@...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA384.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):15360
                              Entropy (8bit):7.44553708409427
                              Encrypted:false
                              SSDEEP:384:zKa0RHzOUcuDNwwElhkLU+6i0cnBBYZa7gJX+:GlRHzWupzElhkLU+d0jpu
                              MD5:78899500F9846A2E96C7C48FCDD009F9
                              SHA1:15F9606987423EC24C618F4CAA92CFEF9258F8BA
                              SHA-256:82866E3650453D1859407E779932DACACA7ADB8B9E2E2D6F1419C1C5D65E164B
                              SHA-512:77FAC5814CD3637A2B47FDE6B2A094EC0356D9A849B47595821EE928CAE8DACB0C3282904CF420E15667BD485F6408AF67699D5C3A3036DD149437BED3029131
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...G..e.........." ...%.@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_SHA512.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):15872
                              Entropy (8bit):7.3733988454718755
                              Encrypted:false
                              SSDEEP:384:FKa0RHzO8srTORYmZbM2mwzvxQREIr8ALZa7gJXB:4lRHz+UYWbM50gr5px
                              MD5:EC3EEACA979B60064E1B65B6D0507E36
                              SHA1:BB2F0ED88501B8DFB4C2295788748D99DDEC13C4
                              SHA-256:A3B3694C202E2DEAAB91671727FF704E3FFC7E08D80C09FB83B891BA30EC0643
                              SHA-512:51B0CC2A3DFDE4029183DC37D7098EC78C7F6F337288C0BF23623BA4A29B49261F9B795603E7723181266F6F930A69C6B70F77E0752E3F92E5C4EC768016F113
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...I..e.........." ...%.@................................................................`.........................................L...........\...........................4...........................................@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_clmul.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10752
                              Entropy (8bit):6.7921072720597175
                              Encrypted:false
                              SSDEEP:192:Dzo1UnFmx7eYCtScDioNWaVkkYj273QJXunThm:Dzzy7RWXbVkZa7gJXO
                              MD5:F739418FA4A594F21D8375F734979B98
                              SHA1:5945079860CF7F282EEE3AE6E39E35866CBE7800
                              SHA-256:E164FAF2C12135EC632D465058974C93D0B48BC13AD0E6E0D48CD1CDD888C656
                              SHA-512:FAB93729286C88379AEB0C4EB8A00440A43ED458AB77123B307DAB0B8DFCBE34BBCA91C182002D637B02178B58E4D7A53A4F6128590B5DD0E97D664A15CCB6C6
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...K..e.........." ...%.0.......p.......................................................`.........................................T..........d............P..................$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_ghash_portable.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10752
                              Entropy (8bit):6.823982230841589
                              Encrypted:false
                              SSDEEP:192:mu1UnFmx7eY5mF2fn/ZJtUSi3m2kYj273QJX8n7B:Sy7R9hS3m2Za7gJXQ
                              MD5:141F0D92A6F9CCD1702A7398086B17CB
                              SHA1:EECB712B76097E34A2DC81E702800BB0402EFCE1
                              SHA-256:148728B95F3F92B7174EF3EE2E4023B0F53747FCCD84E3787AAABBAB682B74FE
                              SHA-512:CE06966D40BEB2459A34EF6578CC251A0D73E01412F61E10F59CB95BFE4D80684D1D2FC623F585CD4EBF5272F85EBCE01C24B637D4A465E90A203E3EB742A180
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%.0.......p.......................................................`.........................................L..........\............P..X...............$......................................@...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_keccak.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):12288
                              Entropy (8bit):7.104874057607472
                              Encrypted:false
                              SSDEEP:192:1w3Spn0Q62BCzNMVDBi8HspQGYGjseFy9gAEkYj273QJXxHe:ICXBCRM+WU4CAEZa7gJXw
                              MD5:BD2F14BF0EB8E592ED0390D723839AEC
                              SHA1:DB06CE883A9F2A14742D758FEDCC7B98F1305F7B
                              SHA-256:3E9366F3F0AA3C873F8E6F964FF36778C25C9AAF7F60AB625BCE3FE4E93304A5
                              SHA-512:2F9EE66078A8EA71F1D108F9062BF47DDC55E03BF926DD5A5DBC8760B6DFA29EF89DC51FCDD4646C877E35316006068ED477C866A34059006F8507697FD24F44
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...J..e.........." ...%.0................................................................`.........................................L...........\............`..p...........@...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Hash\_poly1305.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11776
                              Entropy (8bit):7.004449437417802
                              Encrypted:false
                              SSDEEP:192:xP11I5vOYss/65mtfR/oESVBx5+g7i2kYj273QJXtn7g8:lY9ss/SQ15SVBxzi2Za7gJXm
                              MD5:AE630570348EC9928E418BF3CF84F250
                              SHA1:F3A74A373786D9D1263145E8755EDF131D7AE4EA
                              SHA-256:FDDF13AE44FB2A5266A46C74E89A30428333298E1E0BA99F5B4EDC37548CD2AB
                              SHA-512:515229985587D42CD0D3928E66C32F64872327D998110B7835D1D3F6CBAEAD5930E92FEDEA438EA1679F48A7F25FF76598103331EC437F75233CF4F912466C10
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...K..e.........." ...%.0.......p..`.....................................................`.........................................L..........\............P..|...................................................`...@...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Math\_modexp.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):20480
                              Entropy (8bit):7.5679245622297024
                              Encrypted:false
                              SSDEEP:384:Jp6z102BfyZCpish+INGsJ7Ed2BPZ5CxPFfBShSi8dLTPNZa7gJXtA:JUZ02BfyZF4yBFfrv1pdA
                              MD5:9FDA28383EE442763BC32545EDF7B370
                              SHA1:14C9C9D96182431CC050ED43CCCCD9EE2EC9F8C9
                              SHA-256:7DA6853BDD8FD5F2E9F5AC98AB1F98EA8E69B1F524089BCE6F9335494E677B69
                              SHA-512:D26B391D38DD4246A846EB0A60A90B0DE3DFFF686027FD97E87495BE06EFA7EC60EE026EC0C44DF92D64F2ABBDC1DE6D7467039333E56B65A15F5AD702414351
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.P................................................................`.........................................L...|.......\.......................................................................@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Protocol\_scrypt.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):10240
                              Entropy (8bit):6.814520245777998
                              Encrypted:false
                              SSDEEP:192:g1Qxmkp6MifzJIJI409G/P+hb4HEEeTkYj273QJX432KK:5lo8/0M/P+hkH5eTZa7gJXt
                              MD5:2C3EA7E1895D5A4804FDD5BDAEDB282E
                              SHA1:96C51247AC56D3CC7525B2792C7A7B366F8D0AA7
                              SHA-256:425DD18E3CD2619FF5DBBE4F1E2C043C5E053D839DFDD3C03B1AED432A0BFEB6
                              SHA-512:8E3A67DC864B5FA1600C123D28ED2B38885E0DB2177F07FEF234E9B3DE338168FEACAB1715EA2D3DDD2860E0984C937BEBF3730D37DE9E6C8B89A46E581664D4
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...P..e.........." ...%. .......p.......................................................`.........................................L...d......\............P..4......................................................@...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ec_ws.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):638976
                              Entropy (8bit):7.997940586383953
                              Encrypted:true
                              SSDEEP:12288:VjzZHMHtd1z4H062IfQM8EDPHPodIWchYQYJqhgQ1huBo:1Nqz4UefQ/EDvP7vYlJ2we
                              MD5:AA836CCC148401F90D562CC33984BD54
                              SHA1:1857D1029B872C801EBF30010C14EB100A767F9D
                              SHA-256:50C5F9BF08A1E1830C9C581F3A2E27B5CB4F32A698DECDACE6AB9C4680213B21
                              SHA-512:3BA0709412E083A7352F17D149BD89DF657E4BD3E591F01CDF8AFD6A41945D0D5554AA8941B0F4B117FA04E930E4C8782515094278914FCD321C9DA524F55B78
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d...R..e.........." ...%......... .......0................................................`.........................................L...d.......\...............0.......................................................@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed25519.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):15872
                              Entropy (8bit):7.4496261446037
                              Encrypted:false
                              SSDEEP:384:q/9g+4uX+CdazQ3QpW/YX7DUsTaxj1paZa7gJX8:y8uoQQAQ7DZaIps
                              MD5:F2334D0DD7F099B47D7993EBF0DA4CEB
                              SHA1:66B9B7E969526E86BA5A894B90C5E1EE38D65372
                              SHA-256:62EB9E4C9FAD4AD02F8030A63708371032CA2AB86112AA209ABFEE164AB96AC8
                              SHA-512:C4C5A603FB5C94AA0F9DC869D52C5CA4280917D149C32C3578FEF1C97E7941EA56752380CCBDEA7E636A44BE9C54C4866ABBEA69F140555D9D1823C18296CAB8
                              Malicious:false
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d...R..e.........." ...%.@.......... .....................................................`.........................................L...0.......\...........................|....................................... ...@...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_ed448.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):26624
                              Entropy (8bit):7.747004268303169
                              Encrypted:false
                              SSDEEP:384:Isra4QwN9pWvBmNjICOKhgJLu+W3THheDe/RYdmPT62hIbPj6yZa7gJXSn:7am9pWBO39WkeDe/lPT6QQPOypC
                              MD5:407793DF7C9FB01130E4AB4E3D5EBE87
                              SHA1:CBB22AEFCEE09436B06ED10BD9B00C2213B41859
                              SHA-256:378F571E9B4C1DDE631DE152EC08DE28E08FB14ADC1EDCCC2EF1BAF267D0F438
                              SHA-512:0A522499B7A2C8AD61354DD6771897103A3C83275245BB2301ABBE81796F0EA77C5E18DE46D95384E88D81F164F57A2A022C01F5624BC7BAFEB3390C73771FB4
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.`...........R.......................................p............`.........................................Lb..h....`..\....`.......................c.......................................^..@...........................................UPX0....................................UPX1.....`.......`..................@....rsrc........`.......d..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\PublicKey\_x25519.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):9216
                              Entropy (8bit):6.709323406779303
                              Encrypted:false
                              SSDEEP:192:n51aJhdZfTI6jnLOKzYrkYj273QJXpHza:n5khHOWYrZa7gJXZa
                              MD5:82BB6E1C1007267741EA7747CD3FCA30
                              SHA1:C5810307F1DF869AA80F4B3514C82F814BB06820
                              SHA-256:6FB2FAF00340FFCB71A4DF4A1CF47757E836C99A74F0A05F064525A1406896C0
                              SHA-512:820CF0AEE8729A6AFC92E0D12AC985445CFA490A22B52A78E9987696751CF5D7DB26AB3A3E9953C0AF22E41C528047CB1DBC1735C1269F7BD7D383B0F0F88A2D
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d...R..e.........." ...%. .......p........................................................`.............................................P...................@..............P...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util\_cpuid_c.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):9216
                              Entropy (8bit):6.756224040564772
                              Encrypted:false
                              SSDEEP:192:h51aJhdZfybbmkAsOum8FkYj273QJXpHr:h5kKbxu8FZa7gJXB
                              MD5:1E11FE9316220AE1B4B58F3EDD43E7A7
                              SHA1:EC32F80592D5E3DD75EEADE1D542A645FE5EEB79
                              SHA-256:A0C879E6E344E785D585661EFCEC49E9D08B7412BBA4A7076E04B8A94E50A7F1
                              SHA-512:D426C883CE048D06B585C4F6DBDCA53DAD99A36B3FA417DE7CBC72810B4DDE0B27DBCCCA00106F89782C8DF224A451922848B2340311871B738A33D8EF09C3ED
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%. .......p........................................................`.............................................|...................@..............|...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Cryptodome\Util\_strxor.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):9216
                              Entropy (8bit):6.752491525067528
                              Encrypted:false
                              SSDEEP:192:BeyNdtmbS0qAREp60aNELkYj273QJXEHbH:BeyNdobyARERLZa7gJX4H
                              MD5:5514407EC9A5F75B9FE72A4DCEA9CA1A
                              SHA1:96F0E027BBFD35F817AEB6B5991D89EA8CC8C10F
                              SHA-256:FFEA9F021DF4E5DC728FEABDB3DE15A94CBCBB736FD0301F7772B2046A3B0070
                              SHA-512:5326BC489E106906306FCE2B890C992A114F217D1001AFDAD16061E1E61D71B34DBDA5B0FA4A38F31F77756B1ADC8501EFFB662E028FABE361D064E63056FA83
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...P..e.........." ...%. .......p........................................................`.............................................t...................@..............t...........................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imaging.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):752640
                              Entropy (8bit):7.998296377436021
                              Encrypted:true
                              SSDEEP:12288:op0DgXVWG8dONamNnbdYk6Rlvph5pLHibf3ya/XPpleLFuxV5:op00XJ8dYamHYkehh/jwya/XPPt
                              MD5:267D8640E40D4A5F583565DA89EC221A
                              SHA1:13741624969F6443E45A23C0E435C1D9D6C5F3FE
                              SHA-256:30DEB1A2E1B828623F47BCD76502E74E599258FA4E4166AE6C7423B82282BDFB
                              SHA-512:002526F123DFE774B3B2C0E3473970614E6BCEF3A6ABCAE9ECB3136FEB8E7C4F79AE031DB1776C63B9F5F95D109B992C6AF0FD04A0F060273C2614843FE1C911
                              Malicious:false
                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........S$..=w..=w..=w...w..=w.}<v..=w.}.w..=w.}8v..=w.}9v..=w.}>v..=wx.<v..=w..<v..=w..<w..=w..=w..=w.}9v..=w.}5v..=w.}=v..=w.}.w..=w.}?v..=wRich..=w........................PE..d......f.........." ...&............@#$......................................P$...........`..........................................D$.`....@$......@$......."............. E$.(...........................`/$.(..../$.@...........................................UPX0....................................UPX1.............r..................@....rsrc........@$......v..............@......................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingcms.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):98816
                              Entropy (8bit):7.959858343299162
                              Encrypted:false
                              SSDEEP:3072:r7aSz/RdbWjuZOKrJ/Zp+dZxm8n7w52sgHM:/aSz/2juZOwZZp+dZxm87w52PH
                              MD5:84FCA69DDAFB2A33E361552EADDDF81C
                              SHA1:38A6F44C43895372BF363227CCC6C8FEE9C719CB
                              SHA-256:DD4443022E75D8D526240F790D09841DF3161786404E8D88049F027DC8612972
                              SHA-512:E27029F0409B264E6B0C559594CA956884E73A0E8B5DE6B2596EC3C8DCF91B6052EBF52A44454C0AD526D1EF89B13BE46AFB2B43A66AFF9B3AF46A978FD53436
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..v(..%(..%(..%!.+%&..%...$*..%...$%..%...$ ..%...$,..%..$*..%c.$/..%(..%D..%G..$>..%G..$)..%G.G%)..%G..$)..%Rich(..%........................PE..d......f.........." ...&.............Z....................................................`.........................................|t..h....p.......p.........../...........t.......................................f..@...........................................UPX0....................................UPX1.............x..................@....rsrc........p.......|..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingmath.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):12800
                              Entropy (8bit):7.184052370078995
                              Encrypted:false
                              SSDEEP:384:e0zs4wPljwST14G+x8R6oA6qa+Za7gJXG5:e0z3y9TEx846mp2
                              MD5:68D106AFE450393B379F70513B7DA714
                              SHA1:D0D22386FE48663FF10E2FB099C21FC7CC3931BD
                              SHA-256:72AD913E773CDF39DB099273A7A18A95A1E3F0765687F438E6B2ADE622E55A76
                              SHA-512:57700DA48531BA86F87E6DB0D3F6E2CAFF2BF63F607E616D846DBE19A78EA399652D9B609A75E5B09C4345F9B14C1409A7B20CBDA1EF5A247F3CA85BD9D4A5D9
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.....a..@`...a...`...a..@d...a..@e...a..@b...a...`...a...`...a..@i...a..@a...a..@....a..@c...a.Rich..a.........PE..d......f.........." ...&.0................................................................`.............................................h.......................8.......................................................@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_imagingtk.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11776
                              Entropy (8bit):6.914375908496255
                              Encrypted:false
                              SSDEEP:192:ueib7vaRBCBHqZI8Qmjmuuug7+kYj273QJXhHWYdryE:upWHCtKAuuD7+Za7gJXAYdry
                              MD5:8660429CBB6E5645BA2B03B5B48A9462
                              SHA1:60CD1368028953E294C86802A1B298ACC23290E5
                              SHA-256:579B3969A204D09A87B297DD01AC5FF9924B053D9A715FA3F1073AED1D64837C
                              SHA-512:37B6A759094928D912EEA4E7753A76D88F8B0C47779069ADD4C679B73ACAE02EDD9CC89857060714ACE86320F54AAC47326C3504C002D267EBD1F75EF8807452
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P>R.>mR.>mR.>m[..mX.>mT8?lP.>mT8;l^.>mT8:lZ.>mT8=lQ.>m..?lP.>m..?lW.>mR.?mf.>m=86lP.>m=8>lS.>m=8.mS.>m=8<lS.>mRichR.>m........PE..d......f.........." ...&.0..........0.....................................................`.............................................d....................`..............,.......................................0...@...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\PIL\_webp.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):177664
                              Entropy (8bit):7.984163836837464
                              Encrypted:false
                              SSDEEP:3072:vSk4FQ4Ku8BgIfML2UXU1Q1Pbfrz8LNvoTJe/wpZUvOJaWSiiloBrNbfeKo:6JK4Ku8BP4EaDfONiLqvO0giKr
                              MD5:5889213C4774928FB2CCEFCDA1E58F8C
                              SHA1:2F4A2D83510F240B1CE331B3C13248FC3E38EE23
                              SHA-256:E8D2EBE68C90172A4E94C724CE75572F005AA7793353B86A81C1A312BE9B7DAA
                              SHA-512:83C83B627FD06EE76AA7EB32F452056B6C753AB5F69143657AA6A27DB231BAB0B5C20E0BE19B7386B329E3CAD5D769D7839F179423F81311D2542803290FE716
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.].............vd..............v..............................l{.................................................Rich............PE..d......f.........." ...&......... ..@....0................................................`.........................................x...\....................P...<..................................................@...@...........................................UPX0..... ..............................UPX1.........0......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin\mfc140u.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):5653424
                              Entropy (8bit):6.729277267882055
                              Encrypted:false
                              SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                              MD5:03A161718F1D5E41897236D48C91AE3C
                              SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                              SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                              SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Temp\_MEI59122\Pythonwin\win32ui.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):279040
                              Entropy (8bit):7.864197084585191
                              Encrypted:false
                              SSDEEP:6144:IBjVLw7ShElYer9fB/YSYVye4ZgWJRi/tPUivxJSRYpnRr7G:IBpLwGalYU9fhYVd2gmi/tPUIWRsRr7G
                              MD5:2DC4AFB4D80FE4F45CE23446D27A291E
                              SHA1:0FCDCE4E5ED26B1AD8B9FA3AFFCC3B575F0C0771
                              SHA-256:EFBD6798CE0F26704DF18139BECAF03CA47DA80B5BC127178EB0B67E36C60A69
                              SHA-512:FD686595BACCE76E21CC75A914EF3918BD134E69E3965503DFB0ED3EA5D60ECFB335759F34CF31FDE06519CB1C84539AE5E519D1B3C78A210496669CE48DC273
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." ................0}.......................................0............`..............................................T..<...........<8................... .. ...........................P...(.......8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\VCRUNTIME140.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):109392
                              Entropy (8bit):6.643764685776923
                              Encrypted:false
                              SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                              MD5:870FEA4E961E2FBD00110D3783E529BE
                              SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                              SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                              SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Temp\_MEI59122\VCRUNTIME140_1.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):49488
                              Entropy (8bit):6.652691609629867
                              Encrypted:false
                              SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                              MD5:BBA9680BC310D8D25E97B12463196C92
                              SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                              SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                              SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_asyncio.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):35712
                              Entropy (8bit):7.645244129807927
                              Encrypted:false
                              SSDEEP:768:o2sbZA5n1we/lPgOb1koYpu53VnJ2gl+NfUpv+I75n2EYiSyvPRPxWED:o2RhZtXxkoYiTTENE+I75n2E7SynRPx
                              MD5:233F9C811B60C49E06D453977FC41C65
                              SHA1:97FFEAE5938C919C0733E4B60C79A47A1B173AC7
                              SHA-256:548BAA872C4F1031BC0A77813629C6ECB864E4AB2F653B221BE6A7BAF2E1FC83
                              SHA-512:46C7172E37A019987EC5844913823211F84A093FAEA8A2D7FD5727486AB79886EA0898B19BED18CB7AF9022FEBDAAFA7E154CDBA42423834208531BF79F58E94
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".`.......... #.......................................P............`..........................................J..P....I..P....@......................DK..$................................... /..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_bz2.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):47992
                              Entropy (8bit):7.809914406923306
                              Encrypted:false
                              SSDEEP:768:RiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:R5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
                              MD5:93FE6D3A67B46370565DB12A9969D776
                              SHA1:FF520DF8C24ED8AA6567DD0141EF65C4EA00903B
                              SHA-256:92EC61CA9AC5742E0848A6BBB9B6B4CDA8E039E12AB0F17FB9342D082DDE471B
                              SHA-512:5C91B56198A8295086C61B4F4E9F16900A7EC43CA4B84E793BC8A3FC8676048CAB576E936515BF2971318C7847F1314674B3336FE83B1734F9F70D09615519AC
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_cffi_backend.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):72704
                              Entropy (8bit):7.914710533185775
                              Encrypted:false
                              SSDEEP:1536:wxOMA3pvJDJAc1mHzO0jM0JpVTlJRf1AatOL8ewO6NRQep:E0uc1mTO0Y0b9lJRflOwe1wRQ
                              MD5:76041575BFB6C23F89168485BA802CD3
                              SHA1:740DBBBFB5A48985EE866139B2C3EDCC33E88587
                              SHA-256:3ADF6B1CFCB47D99653C284DC74B13764F960873EDF651E99B52A1B6BA1DF590
                              SHA-512:800FCAC9C2E1312A6F3D46148A9D621ECBDE07B473681D88A383D385C30ADCC660D763A8BABF32B8A4E815B2C2CE4A23D86660403C341F3DBC9EE021DF341070
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.|.B/..CKf#C)..C.|.B&..C.|.B%..C.|.B)..Cfq.B)..C.|.B...C-..C...C.|.B)..C$qKC,..C.|.B,..C.|!C,..C.|.B,..CRich-..C........PE..d.....e.........." ..... .......@..@S...P................................................`..........................................s..l....p.......p..........H...........ht..$...................................@_..8...........................................UPX0.....@..............................UPX1..... ...P......................@....rsrc........p......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_ctypes.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):58232
                              Entropy (8bit):7.819692209624967
                              Encrypted:false
                              SSDEEP:1536:/UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:I3/jolwXuRaW6wUI7QP7h2xB
                              MD5:813FC3981CAE89A4F93BF7336D3DC5EF
                              SHA1:DAFF28BCD155A84E55D2603BE07CA57E3934A0DE
                              SHA-256:4AC7FB7B354069E71EBF7FCC193C0F99AF559010A0AD82A03B49A92DEB0F4D06
                              SHA-512:CE93F21B315D96FDE96517A7E13F66AA840D4AD1C6E69E68389E235E43581AD543095582EBCB9D2C6DDA11C17851B88F5B1ED1D59D354578FE27E7299BBEA1CC
                              Malicious:false
                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................`%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_decimal.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):106368
                              Entropy (8bit):7.93479712134
                              Encrypted:false
                              SSDEEP:3072:ugCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:u1MV2Mz94og2tJePpwpp
                              MD5:F65D2FED5417FEB5FA8C48F106E6CAF7
                              SHA1:9260B1535BB811183C9789C23DDD684A9425FFAA
                              SHA-256:574FE8E01054A5BA07950E41F37E9CF0AEA753F20FE1A31F58E19202D1F641D8
                              SHA-512:030502FA4895E0D82C8CCE00E78831FC3B2E6D956C8CC3B9FB5E50CB23EF07CD6942949A9F16D02DA6908523D9D4EF5F722FB1336D4A80CD944C9F0CB11239AB
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_hashlib.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):34176
                              Entropy (8bit):7.670946753848895
                              Encrypted:false
                              SSDEEP:768:aq3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aEdM1TMho8iMLPmv/AzI75Imy7SyXPxA
                              MD5:4AE75C47DBDEBAA16A596F31B27ABD9E
                              SHA1:A11F963139C715921DEDD24BC957AB6D14788C34
                              SHA-256:2308EE238CC849B1110018B211B149D607BF447F4E4C1E61449049EAB0CF513D
                              SHA-512:E908FECB52268FAC71933E2FDB96E539BDEBE4675DFB50065AEE26727BAC53E07CCA862193BCB3AB72D2AE62D660113A47E73E1E16DB401480E4D3FD34D54FA8
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................p*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_lzma.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):86392
                              Entropy (8bit):7.91766123352546
                              Encrypted:false
                              SSDEEP:1536:EfKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:4qdLCOz76LBl4VxYcdc/11I7e1gfvxs
                              MD5:6F810F46F308F7C6CCDDCA45D8F50039
                              SHA1:6EE24FF6D1C95BA67E1275BB82B9D539A7F56CEA
                              SHA-256:39497259B87038E86C53E7A39A0B5BBBFCEBE00B2F045A148041300B31F33B76
                              SHA-512:C692367A26415016E05EBE828309D3FFEC290C6D2FD8CC7419D529A51B0BEDA00CCDC327C9F187AE3CA0CC96336D23D84A8FF95B729C8958B14FB91B6DA9E878
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_multiprocessing.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):25984
                              Entropy (8bit):7.488187631590162
                              Encrypted:false
                              SSDEEP:768:GIy6HNbpr+8C6LSf93zpALbI7Rt2fYiSyvPPxWEa5Z:39+8FKReLbI7Rt2f7SynPxeZ
                              MD5:3AADB93005D6C2CE4FBA1DAD0C99547F
                              SHA1:64AAEAF0A78BA60CF2C4324FAF3DD94AEEACC297
                              SHA-256:EC92FD9277BB5AF0914C42F09D52651094793A7C4F79C35A4C9E4A2B6F955AF3
                              SHA-512:863A78664A5D43577CC6FFABE6028E8289201A94DB81E00EBB29C301D996A46D496582779F22FD363820A0048245AC68E2AF110231190D4FDA2AB1E7B385BF98
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".0..........p.....................................................`.........................................4...`....................`..........................................................@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_overlapped.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):31104
                              Entropy (8bit):7.628398010929569
                              Encrypted:false
                              SSDEEP:768:fk8GDYwKGtevarixdHpgTzI7st2xYiSyvxPxWEa:UETibTzI7st2x7SypPx
                              MD5:9BD2B167101981C30C89D56492311553
                              SHA1:AA8E175A7894486A16A2D5D3A399C8894A7F1CAE
                              SHA-256:DD32FFBD9580876FB7FD1036F1FC3A6D9788627067AD9B0F3D366017B8865CCC
                              SHA-512:0EC676E62F95B083142461745FDDA699A7EDF8597CEA952BA4297F153A1D11ABEC621D5CE192D0EBDC52EBF3D745BF34F3161F87AD6593153CF1C95ECF474F45
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".@................................................................`.........................................x...X...............................................................................@...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_queue.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):24960
                              Entropy (8bit):7.447047314489284
                              Encrypted:false
                              SSDEEP:768:BSxw19p9opxfI77U2bYiSyvlfUvPxWEl:Bj1HgfI77U2b7SyOvPx
                              MD5:0E7612FC1A1FAD5A829D4E25CFA87C4F
                              SHA1:3DB2D6274CE3DBE3DBB00D799963DF8C3046A1D6
                              SHA-256:9F6965EB89BBF60DF0C51EF0750BBD0655675110D6C42ECA0274D109BD9F18A8
                              SHA-512:52C57996385B9A573E3105EFA09FD6FD24561589B032EF2B2EE60A717F4B33713C35989F2265669F980646D673E3C387B30B9FC98033BB8CA7C59ECE1C17E517
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................`...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_socket.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):42880
                              Entropy (8bit):7.696654190779553
                              Encrypted:false
                              SSDEEP:768:oL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:IkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
                              MD5:7A31BC84C0385590E5A01C4CBE3865C3
                              SHA1:77C4121ABE6E134660575D9015308E4B76C69D7C
                              SHA-256:5614017765322B81CC57D841B3A63CBDC88678FF605E5D4C8FDBBF8F0AC00F36
                              SHA-512:B80CD51E395A3CE6F345B69243D8FC6C46E2E3828BD0A7E63673A508D889A9905D562CAC29F1ED394CCFCDA72F2F2E22F675963DD96261C19683B06DEA0A0882
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................@y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_sqlite3.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):50048
                              Entropy (8bit):7.761194500415829
                              Encrypted:false
                              SSDEEP:1536:c8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:vQO00zrrvbQI75Qr2Nx
                              MD5:BB4AA2D11444900C549E201EB1A4CDD6
                              SHA1:CA3BB6FC64D66DEADDD804038EA98002D254C50E
                              SHA-256:F44D80AB16C27CA65DA23AE5FDA17EB842065F3E956F10126322B2EA3ECDF43F
                              SHA-512:CD3C5704E5D99980109FDC505D39AD5B26A951685E9D8E3FED9E0848CD44E24CC4611669DBDB58ACC20F1F4A5C37D5E01D9D965CF6FE74F94DA1B29AA2FF6931
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|...|...|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...|..........u......}....|.}......}...Rich|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................0...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_ssl.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):62328
                              Entropy (8bit):7.84875298158187
                              Encrypted:false
                              SSDEEP:1536:0edJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:h8tVBPpGsUt+uyuI7t7Q/+xu
                              MD5:081C878324505D643A70EFCC5A80A371
                              SHA1:8BEF8336476D8B7C5C9EF71D7B7DB4100DE32348
                              SHA-256:FCB70B58F94F5B0F9D027999CCE25E99DDCC8124E4DDCC521CB5B96A52FAAA66
                              SHA-512:C36293B968A2F83705815EF3A207E444EEB7667AD9AF61DF75E85151F74F2FE0A299B3B1349DE0D410BBBAEA9F99CAC5228189099A221DE5FA1E20C97C648E32
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................0...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\_uuid.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):22400
                              Entropy (8bit):7.353729594367488
                              Encrypted:false
                              SSDEEP:384:ObjUslT24oGuNZa7gJXTwI7ewWY8IYiSy1pCQDMaPxh8E9VF0Nyvzo:kj3lcNpDwI7ewW4YiSyvfPxWEx
                              MD5:B10F1F10513A8876913AB8E9B2491426
                              SHA1:87E59BFF4BD9AC5842DE4D04DCAA84C870935183
                              SHA-256:9C81EAB871F6324A54F8F6248812EADE891113BF45675A869553427BA5E963DA
                              SHA-512:E589A600D4A6DB7720701E1ED0667E4CAB17AB96930ACFB6B91A2A5BBE5E672B5E4959A1767D5A2F48BCB53B387E5A268BA285B27CC4F08066F40447139E9F9C
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...". .......`.......p................................................`.........................................8...L....................@..........................................................@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\base_library.zip

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:Zip archive data, at least v2.0 to extract, compression method=store
                              Category:dropped
                              Size (bytes):880537
                              Entropy (8bit):5.683035771422093
                              Encrypted:false
                              SSDEEP:12288:lgYJu4KXWyBC6S4IEa8A4a2Y42dOVwx/fpEWertSLMNM:lgYJiVBFLa21nVwx/fpEWe+MNM
                              MD5:22FEE1506D933ABB3335FFB4A1E1D230
                              SHA1:18331CBA91F33FB6B11C6FDEFA031706AE6D43A0
                              SHA-256:03F6A37FC2E166E99CE0AD8916DFB8A70945E089F9FC09B88E60A1649441AB6E
                              SHA-512:3F764337A3FD4F8271CBA9602AEF0663D6B7C37A021389395A00D39BD305D2B927A150C2627B1C629FDBD41C044AF0F7BC9897F84C348C2BCCC085DF911EEE02
                              Malicious:false
                              Preview:PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                              C:\Users\user\AppData\Local\Temp\_MEI59122\certifi\cacert.pem

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):292541
                              Entropy (8bit):6.048162209044241
                              Encrypted:false
                              SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
                              MD5:D3E74C9D33719C8AB162BAA4AE743B27
                              SHA1:EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
                              SHA-256:7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
                              SHA-512:E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
                              Malicious:false
                              Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                              C:\Users\user\AppData\Local\Temp\_MEI59122\charset_normalizer\md.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):9728
                              Entropy (8bit):6.604976146782397
                              Encrypted:false
                              SSDEEP:192:Z16tq4hfGNpeeiTJvbXlikYj273QJXpH48X:Z1gq4hfGNZi1vpiZa7gJX+8
                              MD5:6CB45DDD63C231AFB8D090E6DF919BF8
                              SHA1:88FF70C0704368A35C683C3B460A363F2A840B83
                              SHA-256:7D5F6A03C33226F046A96988BA83BC03D29A776F32DD81DBEB895614CEF76ED3
                              SHA-512:91216757972CCBE2E93E647C64FBAF8E2D29546410A22064779257A5FCDDFF866194ED0DDCF7B15DACEDD2E251CACA6EAD12C00C0254C26352717164294B8E04
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%. .......p........................................................`.........................................@...p......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):39936
                              Entropy (8bit):7.847046321540009
                              Encrypted:false
                              SSDEEP:768:Ytuo81G+O8u/Ox+gOx8DmqXMdRKawNZG5HnzAa+S9FmgZMu2fY3ljm78OApp9:YQohf8umx+gOuDmImZwu5TAqmgZ6ajmG
                              MD5:A2BB62FFF3D5458AE670A5F4D03F9116
                              SHA1:878C92142856719D64EC07F38D4A342D4F7CFD3F
                              SHA-256:C841E4AA267BE53A08AE2B989DABBD5F043661548C34A9916A06CD836A744319
                              SHA-512:AFD0DD3C87015A0A774B3240694C9F4CB4EF50F780679ED1654ECACC930E57871F2672B3D19E5B2EA1E07FF6EC7A21A76262DFBAF6371D731508BD0C1FF3B674
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%.............6.......................................`............`..........................................R..d....P.......P......................<S.......................................B..@...........................................UPX0....................................UPX1................................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\INSTALLER

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):4
                              Entropy (8bit):1.5
                              Encrypted:false
                              SSDEEP:3:Mn:M
                              MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                              SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                              SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                              SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                              Malicious:false
                              Preview:pip.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\LICENSE

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):197
                              Entropy (8bit):4.61968998873571
                              Encrypted:false
                              SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                              MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                              SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                              SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                              SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                              Malicious:false
                              Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\LICENSE.APACHE

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):11360
                              Entropy (8bit):4.426756947907149
                              Encrypted:false
                              SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                              MD5:4E168CCE331E5C827D4C2B68A6200E1B
                              SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                              SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                              SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                              Malicious:false
                              Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\LICENSE.BSD

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):1532
                              Entropy (8bit):5.058591167088024
                              Encrypted:false
                              SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                              MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                              SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                              SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                              SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                              Malicious:false
                              Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\METADATA

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):5430
                              Entropy (8bit):5.111764645976891
                              Encrypted:false
                              SSDEEP:96:DxHpqZink/QIHQIyzQIZQILuQIR8vtklGovuxNx6rIWwCvCCcT+vIrrr9B+M6VwP:vJnkoBs/stL18cT+vIrrxsM6VwDjyeyM
                              MD5:51E28E442AD9F3CA86FC022806F6B860
                              SHA1:EC18E5A627FEBF6FC10FD28F77F03ABE0D45F1D3
                              SHA-256:C783B299BF4110DE7F94A7DA362927657DD1CD0631B00F2D7A2F1242FF4C3A1A
                              SHA-512:A2D54956DE9F2A896B270A6F2F738F1C83F13EBFA013CA21C7C8DE2C02109065EB8FEEE1E1C4B5593A3A91EEBA5CACCF24D174FE7E098A61ED73949330A94E62
                              Malicious:false
                              Preview:Metadata-Version: 2.1..Name: cryptography..Version: 42.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\RECORD

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:CSV text
                              Category:dropped
                              Size (bytes):15325
                              Entropy (8bit):5.565404083454461
                              Encrypted:false
                              SSDEEP:192:oXVxv2sR5jF4e+6tkh4v4Ko29vZ6W1HepPN+NXwvn5ZnM:oXT2sbCWPoIvZ6W1HepPN+9wvnA
                              MD5:5983CF46D3CCF49F05E0EE2A282D9331
                              SHA1:2BB0C625C6E4A80DAE4BCCCC406544C081BC2C73
                              SHA-256:4AA46ECC65DAA2C819B78AB0CFD1A27243822F6BA15EE26A99116E25B2AEC369
                              SHA-512:8F36451E18BF8184256DF83C7A96189097F16CD41FFB41872E158B6356F95D0843AD2AB281033EB827357B6116BD1D1695C2D0FBEE8E2D462B18C44D057DF964
                              Malicious:false
                              Preview:cryptography-42.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-42.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-42.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-42.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-42.0.7.dist-info/METADATA,sha256=x4Oymb9BEN5_lKfaNiknZX3RzQYxsA8tei8SQv9MOho,5430..cryptography-42.0.7.dist-info/RECORD,,..cryptography-42.0.7.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-42.0.7.dist-info/WHEEL,sha256=ZzJfItdlTwUbeh2SvWRPbrqgDfW_djikghnwfRmqFIQ,100..cryptography-42.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=LQGMBOUoJMoUWaehVZlolfa2ksqExrEG39Ii4p8BHUo,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\WHEEL

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):100
                              Entropy (8bit):5.0203365408149025
                              Encrypted:false
                              SSDEEP:3:RtEeX7MWcSlVlbY3KgP+tkKciH/KQLn:RtBMwlVCxWKTQLn
                              MD5:C48772FF6F9F408D7160FE9537E150E0
                              SHA1:79D4978B413F7051C3721164812885381DE2FDF5
                              SHA-256:67325F22D7654F051B7A1D92BD644F6EBAA00DF5BF7638A48219F07D19AA1484
                              SHA-512:A817107D9F70177EA9CA6A370A2A0CB795346C9025388808402797F33144C1BAF7E3DE6406FF9E3D8A3486BDFAA630B90B63935925A36302AB19E4C78179674F
                              Malicious:false
                              Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography-42.0.7.dist-info\top_level.txt

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):13
                              Entropy (8bit):3.2389012566026314
                              Encrypted:false
                              SSDEEP:3:cOv:Nv
                              MD5:E7274BD06FF93210298E7117D11EA631
                              SHA1:7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
                              SHA-256:28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
                              SHA-512:AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
                              Malicious:false
                              Preview:cryptography.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\cryptography\hazmat\bindings\_rust.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):2100736
                              Entropy (8bit):7.999659207803793
                              Encrypted:true
                              SSDEEP:49152:QYIcD5qwHvPgAmGgmQJgtxceY7m3p0FX15FDr9Z00tpvmD1fcEEag730wrqjGDb:QYIQ5qwHVuJgtxcAp2jx5ZfpYdpgwAL
                              MD5:D85FD537A56A67FA5A1AFEC25AFFC010
                              SHA1:47F7F26C6840DE1697D113AB3622235A35277DBB
                              SHA-256:9B1A8477C284AAF301F03A07E76D00398AF03A9203374F6EEC788F6C5118EC09
                              SHA-512:41BD3562490E5D01D4F08E8FCCD8E19BB3F14FEDA143C43A7BBE69D0D98FFC469F72D9072CA012EDD807FBF17B466E677ABA657E1240227327D17B496061889D
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.r.2x..2x..2x..;... x......0x......#x......:x......6x..]...0x..2x...z......#x..]...D{......3x..2x..x......3x......3x..Rich2x..........................PE..d.....9f.........." ...'.. ...... O..#o..0O..................................Po...........`.........................................(Eo.p....@o.(............`j..O...........Eo.,............................/o.(....0o.@...........................................UPX0..... O.............................UPX1...... ..0O... .................@...UPX2.........@o....... .............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\libcrypto-1_1.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):1189728
                              Entropy (8bit):7.945107908450931
                              Encrypted:false
                              SSDEEP:24576:jffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:Tf8JWwgho5HL3fknPSIKorCU1CPwDv3a
                              MD5:DAA2EED9DCEAFAEF826557FF8A754204
                              SHA1:27D668AF7015843104AA5C20EC6BBD30F673E901
                              SHA-256:4DAB915333D42F071FE466DF5578FD98F38F9E0EFA6D9355E9B4445FFA1CA914
                              SHA-512:7044715550B7098277A015219688C7E7A481A60E4D29F5F6558B10C7AC29195C6D5377DC234DA57D9DEF0C217BB3D7FECA332A64D632CA105503849F15E057EA
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\libffi-7.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):24088
                              Entropy (8bit):7.527291720504194
                              Encrypted:false
                              SSDEEP:384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
                              MD5:6F818913FAFE8E4DF7FEDC46131F201F
                              SHA1:BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
                              SHA-256:3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
                              SHA-512:5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\libssl-1_1.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):208224
                              Entropy (8bit):7.9214932539909775
                              Encrypted:false
                              SSDEEP:3072:5SI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:EIek5VC0FiHof6Z1rgJ63R/oS3
                              MD5:EAC369B3FDE5C6E8955BD0B8E31D0830
                              SHA1:4BF77158C18FE3A290E44ABD2AC1834675DE66B4
                              SHA-256:60771FB23EE37B4414D364E6477490324F142A907308A691F3DD88DC25E38D6C
                              SHA-512:C51F05D26FDA5E995FE6763877D4FCDB89CD92EF2D6EE997E49CC1EE7A77146669D26EC00AD76F940EF55ADAE82921DEDE42E55F51BD10D1283ECFE7C5009778
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\psutil\_psutil_windows.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):32256
                              Entropy (8bit):7.726901563596422
                              Encrypted:false
                              SSDEEP:768:XvaDMlccGli4/1LnromOJjNOzhtPTXuwKuzpSp6:XvaQlmUQFnrobNEht6wDY
                              MD5:937FA2077AD3FB82F9EDC419627969A3
                              SHA1:381011C5B575C03AB77AB943920B39EF8EC8E57B
                              SHA-256:633FB691BC13E4D42B9CAA0AF3A0897E081C8CCCDAB37530745598FBA597A4C2
                              SHA-512:DEB6F7F0DD850528AA78C32FDCB42E836507ED7DC1F198C4903810DBBA47EF37B87CABAE7F148F9017D6F628D93904250A11CDCE05D5E29758A422285B01025A
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`T..$5..$5..$5..-M3..5..v@..&5..v@..(5..v@..,5..v@.. 5...k..&5..oM..55..$5...5...@..45...@..%5...@_.%5...@..%5..Rich$5..........................PE..d.....e.........." .................T....................................................`.........................................8u..`....p..H....p.......................u.......................................`..8...........................................UPX0....................................UPX1.............t..................@....rsrc........p.......x..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\pyexpat.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):88440
                              Entropy (8bit):7.916428215878346
                              Encrypted:false
                              SSDEEP:1536:hqOsxiaMRf0wQhTR0lJrTMQLFrwAx0qHMKVqhgjOE+hpeWpUM2MkNphoacI7QhgR:Q8kmJfMQLFD+XWq+aDBplFkKI7QhgB0g
                              MD5:0BCFD9AA6131D40693EA77FB593F6E2F
                              SHA1:8B837D663AC7E186C7E427A272C7403C880A9D5F
                              SHA-256:0B966BB1C97B5947A01AF98ABBE636F34BD492EDEBA99CE0276108FBE07D2EA6
                              SHA-512:683B9C2C5B810CFEF68F684B2927A2123FF4ACF2D5377B368FE1D69054EBD2D96E99E850BD8C77A2950D55CE96ADA7AD7DB81B6C309D0FE7058FD9FD7E2524B3
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.|...u..|...u.|..Rich}..................PE..d...+..c.........." ...". ........... .......................................@............`..........................................<..P....9.......0.......................<.......................................,..@...........................................UPX0....................................UPX1..... ..........................@....rsrc........0......."..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\python3.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):64896
                              Entropy (8bit):6.101810529421494
                              Encrypted:false
                              SSDEEP:768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
                              MD5:C17B7A4B853827F538576F4C3521C653
                              SHA1:6115047D02FBBAD4FF32AFB4EBD439F5D529485A
                              SHA-256:D21E60F3DFBF2BAB0CC8A06656721FA3347F026DF10297674FC635EBF9559A68
                              SHA-512:8E08E702D69DF6840781D174C4565E14A28022B40F650FDA88D60172BE2D4FFD96A3E9426D20718C54072CA0DA27E0455CC0394C098B75E062A27559234A3DF7
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d......c.........." ..."..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Temp\_MEI59122\python310.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):1513336
                              Entropy (8bit):7.991995760990047
                              Encrypted:true
                              SSDEEP:24576:Umhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:UmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
                              MD5:178A0F45FDE7DB40C238F1340A0C0EC0
                              SHA1:DCD2D3D14E06DA3E8D7DC91A69B5FD785768B5FE
                              SHA-256:9FCB5AD15BD33DD72122A171A5D950E8E47CEDA09372F25DF828010CDE24B8ED
                              SHA-512:4B790046787E57B9414A796838A026B1530F497A75C8E62D62B56F8C16A0CBEDBEFAD3D4BE957BC18379F64374D8D3BF62D3C64B53476C7C5005A7355ACD2CEE
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pythoncom310.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):198144
                              Entropy (8bit):7.89890407356889
                              Encrypted:false
                              SSDEEP:6144:wrs7d9ovn0ICgOdewE9SJy9sZQ3Kfk1pd:R59ovn0IC1yl3H1pd
                              MD5:2734510F76721A1C8EA6A51B09A75A96
                              SHA1:06FBF486565E48ADF1194B61D59F89762C1744BD
                              SHA-256:24E5AC372291424C9C6FD8447932EE326EB79E907D19F0E95FA21B274D5782D6
                              SHA-512:0D9FA8728099C141D832CBEB419D7B0185AC03A9A40900872026BB21A52F9CCF4A5489F35E37E89917298F6B82AC8C8F9FDC1E87439CCBBD471C35221E6D5449
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." .........p.......7....................................................`.........................................0W...c..pS.......P..p....@...z..................................................C..8...........................................UPX0....................................UPX1................................@....rsrc....p...P...l..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\pywin32_system32\pywintypes310.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):63488
                              Entropy (8bit):7.57146672365253
                              Encrypted:false
                              SSDEEP:1536:+2xBKwcTFzoNwouLGtUHhYrn/iraujB/uJm8ei:+aBKwGOwoKGtUHhsnav1/uTe
                              MD5:004C56C566863587F81AC8FDF831AD7C
                              SHA1:13E07A667E1A34ACC263495654740AF41899CAAE
                              SHA-256:775B9ED9A1981481F1E65135568E2EC7B2DF8E7E9A484F15A0F8FBCE4C3A9E9C
                              SHA-512:792E6E2814504B5191946270E39D8B80478CE0457F157113A3C48A7B28C387942EC0B9A6BBEE54D4A179FC5B97FCBC8A07B3FC4ABDC8826097F38F20C89726D0
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........P.......z....................................................`.........................................p...dB..p...........p.......L.......................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\select.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):24952
                              Entropy (8bit):7.392326214954849
                              Encrypted:false
                              SSDEEP:384:+m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:11gl65HKNp5DCI77G2WYiSyv87PxWEgC
                              MD5:666358E0D7752530FC4E074ED7E10E62
                              SHA1:B9C6215821F5122C5176CE3CF6658C28C22D46BA
                              SHA-256:6615C62FA010BFBA5527F5DA8AF97313A1AF986F8564277222A72A1731248841
                              SHA-512:1D3D35C095892562DDD2868FBD08473E48B3BB0CB64EF9CCC5550A06C88DDA0D82383A1316B6C5584A49CA28ED1EF1E5CA94EC699A423A001CCD952BD6BD553D
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\INSTALLER

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):4
                              Entropy (8bit):1.5
                              Encrypted:false
                              SSDEEP:3:Mn:M
                              MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                              SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                              SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                              SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                              Malicious:false
                              Preview:pip.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\LICENSE

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):1050
                              Entropy (8bit):5.072538194763298
                              Encrypted:false
                              SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                              MD5:7A7126E068206290F3FE9F8D6C713EA6
                              SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                              SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                              SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                              Malicious:false
                              Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\METADATA

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):6301
                              Entropy (8bit):5.107162422517841
                              Encrypted:false
                              SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                              MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                              SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                              SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                              SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                              Malicious:false
                              Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\RECORD

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:CSV text
                              Category:dropped
                              Size (bytes):37694
                              Entropy (8bit):5.560695955910088
                              Encrypted:false
                              SSDEEP:384:DDz9AkShgQUgq/kc2mIkpIVh498WjXYW1P5+Eu8X62aDoaQPKJfRQIbwA+hof2yf:Dn3OIyQgIAY8T/7T962lSsSGxt9Im
                              MD5:E30355B5F7466BEE1691929B05EED672
                              SHA1:B9F1275EF04F2D36DD1F801DE116AC12AA68722E
                              SHA-256:CEBD9639E6923A470E818350691053C3CC846A72426A9BFCB70F092868FA0D5B
                              SHA-512:C7A56FE3037A07035279FF063406F7999360D5B275D743C0EF88335EB98BE4CA539775CC1470BF121CE166AA53E3E55002BE7402350E62811EA2B4D0BBD6A617
                              Malicious:false
                              Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-310.pyc,,.._distutils_hack/__pycache__/override.cpython-310.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-310.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\WHEEL

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):92
                              Entropy (8bit):4.820827594031884
                              Encrypted:false
                              SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                              MD5:4D57030133E279CEB6A8236264823DFD
                              SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                              SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                              SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                              Malicious:false
                              Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\entry_points.txt

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):2740
                              Entropy (8bit):4.540737240939103
                              Encrypted:false
                              SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                              MD5:D3262B65DB35BFFAAC248075345A266C
                              SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                              SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                              SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                              Malicious:false
                              Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                              C:\Users\user\AppData\Local\Temp\_MEI59122\setuptools-65.5.0.dist-info\top_level.txt

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):41
                              Entropy (8bit):3.9115956018096876
                              Encrypted:false
                              SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                              MD5:789A691C859DEA4BB010D18728BAD148
                              SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                              SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                              SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                              Malicious:false
                              Preview:_distutils_hack.pkg_resources.setuptools.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\sqlite3.dll

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):623480
                              Entropy (8bit):7.993502110233887
                              Encrypted:true
                              SSDEEP:12288:IZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:YNPsHzTaWwdS5xV70QYMDiCc34e8nI82
                              MD5:BD2819965B59F015EC4233BE2C06F0C1
                              SHA1:CFF965068F1659D77BE6F4942CA1ADA3575CA6E2
                              SHA-256:AB072D20CEE82AE925DAE78FD41CAE7CD6257D14FD867996382A69592091D8EC
                              SHA-512:F7758BD71D2AD236BF3220DB0AD26F3866D9977EAB311A5912F6E079B59FA918735C852DE6DBF7B5FEE9E04124BC0CD438C4C71EDC0C04309330108BA0085D59
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\unicodedata.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):294784
                              Entropy (8bit):7.987175768019268
                              Encrypted:false
                              SSDEEP:6144:PudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:EGEjyirGd+f3FIp7eMHS+CUUr
                              MD5:7A462A10AA1495CEF8BFCA406FB3637E
                              SHA1:6DCBD46198B89EF3007C76DEB42AB10BA4C4CF40
                              SHA-256:459BCA991FCB88082D49D22CC6EBFFE37381A5BD3EFCC77C5A52F7A4BB3184C0
                              SHA-512:D2B7C6997B4BD390257880A6F3336E88D1DD7159049811F8D7C54E3623E9B033E18E8922422869C81DE72FC8C10890C173D8A958D192DD03BFC57CFFAEA1AC7B
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................@b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\INSTALLER

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):4
                              Entropy (8bit):1.5
                              Encrypted:false
                              SSDEEP:3:Mn:M
                              MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                              SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                              SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                              SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                              Malicious:false
                              Preview:pip.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\LICENSE.txt

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):1107
                              Entropy (8bit):5.115074330424529
                              Encrypted:false
                              SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                              MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                              SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                              SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                              SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                              Malicious:false
                              Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                              C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\METADATA

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:Unicode text, UTF-8 text
                              Category:dropped
                              Size (bytes):2153
                              Entropy (8bit):5.088249746074878
                              Encrypted:false
                              SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                              MD5:EBEA27DA14E3F453119DC72D84343E8C
                              SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                              SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                              SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                              Malicious:false
                              Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                              C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\RECORD

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:CSV text
                              Category:dropped
                              Size (bytes):4481
                              Entropy (8bit):5.706524629349948
                              Encrypted:false
                              SSDEEP:96:sqkXVom4ix01TQIvLgAoDH/H7vp88FxTXiJP+GJPSocKEJq5sZF3GI78IegK5Eef:sqkXVwMbY+USocKEJq5sZF3GeV2BvTR5
                              MD5:737488B0DD7D0240F05F54DCB0043E8E
                              SHA1:FBE5D908B995B517BC83C5B29DDE60B27709731D
                              SHA-256:E004D239B653932668962DC96AA60D6B0B0934168E805C9978DB23135E231BB1
                              SHA-512:7B813D7E712E5CB15B094F9BA97B5809D444678D366A8C55AF6BACE25DAB303AE8BD65AE99E9C864FB5DE87BB2BBF717061CD4A9ACA93E200F6C1A748D047C49
                              Malicious:false
                              Preview:../../Scripts/wheel.exe,sha256=yCF6Aw9_GVlnEqG3UM6MzBMPPBTnmeCOI5ZesiQ2Go4,108411..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-310.pyc,,..wheel/__pycache__/__main__.cpython-310.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-310.pyc,,..wheel/__pycache__/bdist_wheel.cpython-310.pyc,,..wheel/__pycache__/macosx_libfile.cpython-310.pyc,,..wheel/__pycache__/metadata.cpython-310.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\WHEEL

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):81
                              Entropy (8bit):4.672346887071811
                              Encrypted:false
                              SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                              MD5:24019423EA7C0C2DF41C8272A3791E7B
                              SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                              SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                              SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                              Malicious:false
                              Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                              C:\Users\user\AppData\Local\Temp\_MEI59122\wheel-0.43.0.dist-info\entry_points.txt

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):104
                              Entropy (8bit):4.271713330022269
                              Encrypted:false
                              SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                              MD5:6180E17C30BAE5B30DB371793FCE0085
                              SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                              SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                              SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                              Malicious:false
                              Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\win32\_win32sysloader.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):11776
                              Entropy (8bit):6.763938186711424
                              Encrypted:false
                              SSDEEP:192:lbadimkU6KnFt4Zdcpbd8m5OonxCe4W7Oj5a5RkYj273QJXhc7o/UQ0D:I4KFtycpbd8EOonxCeZOFa5RZa7gJX+/
                              MD5:35D31B31CABA2BFB17F7830084EF5457
                              SHA1:22DB0C16B06A6DECD41F19C24FB9C4AE1CEFEEA3
                              SHA-256:5EA82777477433280BF86768C924D08B80AFCCCD34CED3FCF8CFEE97E43567C0
                              SHA-512:B8D36D734AA9C9FC3A3872F5145480517294A2D6253BF5A903607AC8EE39616E068626FC90981188C07BA726224EDC48FF0D59661D5A39951AD999BE313E630B
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." .....0.......... .....................................................`.............................................`...x...P.......x....`..............(....................................... ...8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32api.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):49664
                              Entropy (8bit):7.83316826018071
                              Encrypted:false
                              SSDEEP:768:lBHqNUpP9700eM3qeU4NWAXcnLim2sp94osOk7OPBBho8rzspYJP0Upyle:lBzrSeUGQLi+5sOt5Bbzs2ole
                              MD5:1151DC5D219FC1D5A2504484D416C64E
                              SHA1:E253E8CD01A6729927D6E2E391B2582214FADE56
                              SHA-256:BF3EAD408174E1107396BFC989428DB75DC11BB22CC464C886BC3BD42D1D6D94
                              SHA-512:A8862D878B26339BC24AADAA979E0F289F26EADB83C39420EF1D16ABF2607E648AA4C17E82FE18926246D90002FC6FDA4492BCF7796D5115A69CF12DA33B13BB
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." ................@.....................................................`.........................................(.......`...........`...........................................................@...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32crypt.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):52736
                              Entropy (8bit):7.732239372843403
                              Encrypted:false
                              SSDEEP:1536:E/uTkXr2LgA+Q0/W25PVt9sjTQaFoJ7e3eDdJabM:yXXr2ga0BVtmFyJiuDDa
                              MD5:4A81CC314EB7A7E6268BC9972A75BF90
                              SHA1:FADEA11E9387D42B5A0FD53D6F71BD8F3F1A7874
                              SHA-256:C47E972165BF6B7D9A6683D7284AE8173AA8FAF41E1E61AE253230CA01F4747E
                              SHA-512:2414854D98FD9B437EFF0B348B13FD237A376E3CD80AB8B2C63A805C0EE912163008DBAFD74AB5EECB434D329B2396996840AFF3C5E6643CEBFADA08A3699F6E
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................J.........................................`..............................................Rich............PE..d......d.........." .........0.......G....................................................`.........................................hf......hc.......`..h...................$........................................S..8...........................................UPX0....................................UPX1................................@....rsrc....0...`...$..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\win32\win32trace.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):14848
                              Entropy (8bit):7.075583352925283
                              Encrypted:false
                              SSDEEP:384:26KwMJFoeBJ4qCKU7xe+16ufjISGhZa7gJXfO1B1r:27wMJFoenUk/ufapvwBN
                              MD5:D2F8515B8453EE630895BFE02BA9B9F5
                              SHA1:69C67EE4838C3B9CCC5F381634ECF4D20353A646
                              SHA-256:427B7516C3C6095DB49AD6E4B3436CA78C63551A882EE87685FAC30E10A56596
                              SHA-512:35951C9CFFECEB5F1101215B59D2F0A612FBD14D6AE707CB51DF3723430064F07601590C80602FB3FC95DDDF9F47171F60F6A67A60F3ED2044BCF59D854CEB8C
                              Malicious:false
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....0..........`.....................................................`.............................................T...h...8.......h....p......................................................`...8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\_MEI59122\win32com\shell\shell.pyd

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):152576
                              Entropy (8bit):7.97184573578702
                              Encrypted:false
                              SSDEEP:3072:zA+IckcVeE911B9PROpB23W4Ukx0xluxTZ/7cpltdYwT7VbbteHH:05cv91jtROLH4n0xluxIlT7e
                              MD5:9106C16A016FC0D195421ACE7835B412
                              SHA1:1F989739A3D1D2FC4569ADD145A4AF13F8614F5C
                              SHA-256:749F726459B2A0300A8CCD19904EC39A4651538D7B2C66D3FB90A18090BC73FD
                              SHA-512:F8F3A52BC7092B80C969692B720356ADB4A17D05FFB16E869BD7B51E520EAC6A030161E784DE2870BDFF18AA26611964122BD8701EA70A3D7FA5EDC9D314FCE4
                              Malicious:false
                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." .....P...................................................0............`..........................................&..L...P#..t.... ..P.......xx...........'...................................... ...8...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........ .......L..............@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                              C:\Users\user\AppData\Local\Temp\dd_setup.txt

                              Download File
                              Process:C:\Users\user\Desktop\Colby Dupe Script.exe
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):18
                              Entropy (8bit):3.3082708345352603
                              Encrypted:false
                              SSDEEP:3:LAD6Tsn:UeTs
                              MD5:D6C25D0035D976FBE55C8210BA9E7891
                              SHA1:83261B7821592830352892A4E13F1EF91B8F7822
                              SHA-256:7D3449E921914DBB3BD92CDBB3BA4B3E6FCA01BC5BABB94A89EF21DFD58D17B8
                              SHA-512:F13BAEEB475C24BC3C47477D47F168B28D4CA54E8471AF950EFDDF02AC80E7A85DD3D0D0452FFEF462FACEF011846DE40CF4898A1A75E7B5574A0DF0F724FAA4
                              Malicious:false
                              Preview:1715732695.7405698

                              Static File Info

                              General

                              File type:PE32+ executable (GUI) x86-64, for MS Windows
                              Entropy (8bit):5.911050878613387
                              TrID:
                              • Win64 Executable GUI (202006/5) 92.65%
                              • Win64 Executable (generic) (12005/4) 5.51%
                              • Generic Win/DOS Executable (2004/3) 0.92%
                              • DOS Executable Generic (2002/1) 0.92%
                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                              File name:Colby Dupe Script.exe
                              File size:27'886'092 bytes
                              MD5:67bd09879e6fe66763074091f57f3150
                              SHA1:43825d37d0821a6a21aee73e30ecb71c04b14119
                              SHA256:5604246ead9eb4b6ddd749a285e1bb3296f186988c3eb298964a3138cece1446
                              SHA512:668d8048608bf31795fd743d34b8210d2a8b75b3e5c119acfa5d790e06aba0c06cc3f95f2b219879f80ea4201de89d04e99255cda30d6ae0d3c7de3578fb3e88
                              SSDEEP:393216:Io9D7E9QdXG45L1V8dJKFqy4gst0BPeiz+xy446iU:19cQPR4hveGYv4P
                              TLSH:BF5733605B654092E4FAD23F441A89BC8570FC0217E4EACE9278A6AD5FE33545D3BFB0
                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................-.....................,.............................................................Rich...........

                              File Icon

                              Icon Hash:90cececece8e8eb0

                              Static PE Info

                              General

                              Entrypoint:0x14000c540
                              Entrypoint Section:.text
                              Digitally signed:false
                              Imagebase:0x140000000
                              Subsystem:windows gui
                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                              Time Stamp:0x66438029 [Tue May 14 15:15:53 2024 UTC]
                              TLS Callbacks:
                              CLR (.Net) Version:
                              OS Version Major:5
                              OS Version Minor:2
                              File Version Major:5
                              File Version Minor:2
                              Subsystem Version Major:5
                              Subsystem Version Minor:2
                              Import Hash:f4f2e2b03fe5666a721620fcea3aea9b

                              Entrypoint Preview

                              Instruction
                              dec eax
                              sub esp, 28h
                              call 00007F43BCCC8B0Ch
                              dec eax
                              add esp, 28h
                              jmp 00007F43BCCC872Fh
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              int3
                              dec eax
                              sub esp, 28h
                              call 00007F43BCCC9084h
                              test eax, eax
                              je 00007F43BCCC88D3h
                              dec eax
                              mov eax, dword ptr [00000030h]
                              dec eax
                              mov ecx, dword ptr [eax+08h]
                              jmp 00007F43BCCC88B7h
                              dec eax
                              cmp ecx, eax
                              je 00007F43BCCC88C6h
                              xor eax, eax
                              dec eax
                              cmpxchg dword ptr [00034FACh], ecx
                              jne 00007F43BCCC88A0h
                              xor al, al
                              dec eax
                              add esp, 28h
                              ret
                              mov al, 01h
                              jmp 00007F43BCCC88A9h
                              int3
                              int3
                              int3
                              dec eax
                              sub esp, 28h
                              test ecx, ecx
                              jne 00007F43BCCC88B9h
                              mov byte ptr [00034F95h], 00000001h
                              call 00007F43BCCC8E91h
                              call 00007F43BCCC9498h
                              test al, al
                              jne 00007F43BCCC88B6h
                              xor al, al
                              jmp 00007F43BCCC88C6h
                              call 00007F43BCCD742Fh
                              test al, al
                              jne 00007F43BCCC88BBh
                              xor ecx, ecx
                              call 00007F43BCCC94A8h
                              jmp 00007F43BCCC889Ch
                              mov al, 01h
                              dec eax
                              add esp, 28h
                              ret
                              int3
                              int3
                              inc eax
                              push ebx
                              dec eax
                              sub esp, 20h
                              cmp byte ptr [00034F5Ch], 00000000h
                              mov ebx, ecx
                              jne 00007F43BCCC8919h
                              cmp ecx, 01h
                              jnbe 00007F43BCCC891Ch
                              call 00007F43BCCC8FFAh
                              test eax, eax
                              je 00007F43BCCC88DAh
                              test ebx, ebx
                              jne 00007F43BCCC88D6h
                              dec eax
                              lea ecx, dword ptr [00034F46h]
                              call 00007F43BCCD7222h

                              Data Directories

                              NameVirtual AddressVirtual Size Is in Section
                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IMPORT0x3e0bc0x78.rdata
                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000x568.rsrc
                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x430000x231c.pdata
                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x480000x758.reloc
                              IMAGE_DIRECTORY_ENTRY_DEBUG0x3b4600x1c.rdata
                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3b3200x140.rdata
                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IAT0x2c0000x438.rdata
                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                              Sections

                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                              .text0x10000x2afb00x2b00040bf1edebd1304ce1b08c50cb556d4dbFalse0.5458416606104651data6.5002315273868IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              .rdata0x2c0000x12f360x130007a96e255248c804335f945bda41cfe3aFalse0.5160747327302632data5.827936865401172IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .data0x3f0000x33b80xe00ae0f42b168987b17129506ccc4960b21False0.13392857142857142firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 256.0.512, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes1.8264700601019173IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                              .pdata0x430000x231c0x2400ffc5390666982cab67e3c9bf8e263bc3False0.4784071180555556data5.382434020909434IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              _RDATA0x460000x1f40x200771f0b097891d31289bb68f0eb426e66False0.529296875data3.713242247775091IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .rsrc0x470000x5680x6001f909f1505d4aac403fc692b4e3c4933False0.4375data5.515698942150982IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .reloc0x480000x7580x8007ecf18b15822e1aa4c79b9a361f07c79False0.546875data5.250941834312499IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                              Resources

                              NameRVASizeTypeLanguageCountryZLIB Complexity
                              RT_MANIFEST0x470580x50dXML 1.0 document, ASCII text0.4694508894044857

                              Imports

                              DLLImport
                              USER32.dllCreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                              COMCTL32.dll
                              KERNEL32.dllIsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, CreateFileW, GetFinalPathNameByHandleW, CloseHandle, GetModuleFileNameW, CreateSymbolicLinkW, GetCPInfo, GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, GetProcAddress, GetSystemTimeAsFileTime, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                              ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                              GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                              Network Behavior

                              Network Port Distribution

                              TCP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              May 15, 2024 02:24:57.082135916 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.082165956 CEST44349731172.67.74.152192.168.2.4
                              May 15, 2024 02:24:57.084391117 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.096703053 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.096719980 CEST44349731172.67.74.152192.168.2.4
                              May 15, 2024 02:24:57.327374935 CEST44349731172.67.74.152192.168.2.4
                              May 15, 2024 02:24:57.327717066 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.327735901 CEST44349731172.67.74.152192.168.2.4
                              May 15, 2024 02:24:57.328915119 CEST44349731172.67.74.152192.168.2.4
                              May 15, 2024 02:24:57.328969955 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.329458952 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.329596996 CEST49731443192.168.2.4172.67.74.152
                              May 15, 2024 02:24:57.329598904 CEST44349731172.67.74.152192.168.2.4
                              May 15, 2024 02:24:57.329644918 CEST49731443192.168.2.4172.67.74.152

                              UDP Packets

                              TimestampSource PortDest PortSource IPDest IP
                              May 15, 2024 02:24:56.964124918 CEST5943653192.168.2.41.1.1.1
                              May 15, 2024 02:24:57.074465990 CEST53594361.1.1.1192.168.2.4

                              DNS Queries

                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                              May 15, 2024 02:24:56.964124918 CEST192.168.2.41.1.1.10x6327Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false

                              DNS Answers

                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                              May 15, 2024 02:24:57.074465990 CEST1.1.1.1192.168.2.40x6327No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                              May 15, 2024 02:24:57.074465990 CEST1.1.1.1192.168.2.40x6327No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                              May 15, 2024 02:24:57.074465990 CEST1.1.1.1192.168.2.40x6327No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false

                              Statistics

                              CPU Usage

                              Click to jump to process

                              Memory Usage

                              Click to jump to process

                              High Level Behavior Distribution

                              Click to dive into process behavior distribution

                              Behavior

                              Click to jump to process

                              System Behavior

                              General

                              Target ID:0
                              Start time:02:24:52
                              Start date:15/05/2024
                              Path:C:\Users\user\Desktop\Colby Dupe Script.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\Users\user\Desktop\Colby Dupe Script.exe"
                              Imagebase:0x7ff698ee0000
                              File size:27'886'092 bytes
                              MD5 hash:67BD09879E6FE66763074091F57F3150
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:1
                              Start time:02:24:54
                              Start date:15/05/2024
                              Path:C:\Users\user\Desktop\Colby Dupe Script.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\Users\user\Desktop\Colby Dupe Script.exe"
                              Imagebase:0x7ff698ee0000
                              File size:27'886'092 bytes
                              MD5 hash:67BD09879E6FE66763074091F57F3150
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1711175421.0000012E33430000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1706757137.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1715762119.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1704964886.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1707046871.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1707046871.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1706862797.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1706862797.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1706447898.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1708877182.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1720480190.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000002.1720480190.0000012E33431000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1709214739.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1709214739.0000012E33412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000002.1724839216.0000012E34540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_LunaLogger, Description: Yara detected Luna Logger, Source: 00000001.00000003.1709585773.0000012E3341D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                              Reputation:low
                              Has exited:true

                              General

                              Target ID:2
                              Start time:02:24:54
                              Start date:15/05/2024
                              Path:C:\Windows\System32\cmd.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\system32\cmd.exe /c "ver"
                              Imagebase:0x7ff6a4180000
                              File size:289'792 bytes
                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:true

                              General

                              Target ID:3
                              Start time:02:24:54
                              Start date:15/05/2024
                              Path:C:\Windows\System32\conhost.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Imagebase:0x7ff7699e0000
                              File size:862'208 bytes
                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:high
                              Has exited:true

                              Disassembly

                              Reset < >

                                Execution Graph

                                Execution Coverage:11.2%
                                Dynamic/Decrypted Code Coverage:0%
                                Signature Coverage:23%
                                Total number of Nodes:2000
                                Total number of Limit Nodes:75
                                execution_graph 16433 7ff698eeb5a0 16434 7ff698eeb5ce 16433->16434 16435 7ff698eeb5b5 16433->16435 16435->16434 16438 7ff698efe3ac 16435->16438 16439 7ff698efe3f7 16438->16439 16443 7ff698efe3bb _findclose 16438->16443 16440 7ff698ef5cb4 _findclose 11 API calls 16439->16440 16442 7ff698eeb62c 16440->16442 16441 7ff698efe3de RtlAllocateHeap 16441->16442 16441->16443 16443->16439 16443->16441 16444 7ff698f043e0 _findclose 2 API calls 16443->16444 16444->16443 16445 7ff698f01720 16446 7ff698f01744 16445->16446 16449 7ff698f01754 16445->16449 16447 7ff698ef5cb4 _findclose 11 API calls 16446->16447 16467 7ff698f01749 16447->16467 16448 7ff698f01a34 16451 7ff698ef5cb4 _findclose 11 API calls 16448->16451 16449->16448 16450 7ff698f01776 16449->16450 16452 7ff698f01797 16450->16452 16600 7ff698f01ddc 16450->16600 16453 7ff698f01a39 16451->16453 16456 7ff698f01809 16452->16456 16458 7ff698f017bd 16452->16458 16463 7ff698f017fd 16452->16463 16455 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16453->16455 16455->16467 16460 7ff698eff948 _findclose 11 API calls 16456->16460 16474 7ff698f017cc 16456->16474 16457 7ff698f018b6 16466 7ff698f018d3 16457->16466 16475 7ff698f01925 16457->16475 16615 7ff698efa474 16458->16615 16464 7ff698f0181f 16460->16464 16462 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16462->16467 16463->16457 16463->16474 16621 7ff698f081dc 16463->16621 16468 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16464->16468 16471 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16466->16471 16472 7ff698f0182d 16468->16472 16469 7ff698f017e5 16469->16463 16477 7ff698f01ddc 45 API calls 16469->16477 16470 7ff698f017c7 16473 7ff698ef5cb4 _findclose 11 API calls 16470->16473 16476 7ff698f018dc 16471->16476 16472->16463 16472->16474 16479 7ff698eff948 _findclose 11 API calls 16472->16479 16473->16474 16474->16462 16475->16474 16478 7ff698f0422c 40 API calls 16475->16478 16486 7ff698f018e1 16476->16486 16657 7ff698f0422c 16476->16657 16477->16463 16480 7ff698f01962 16478->16480 16481 7ff698f0184f 16479->16481 16482 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16480->16482 16484 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16481->16484 16485 7ff698f0196c 16482->16485 16484->16463 16485->16474 16485->16486 16487 7ff698f01a28 16486->16487 16491 7ff698eff948 _findclose 11 API calls 16486->16491 16489 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16487->16489 16488 7ff698f0190d 16490 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16488->16490 16489->16467 16490->16486 16492 7ff698f019b0 16491->16492 16493 7ff698f019c1 16492->16493 16494 7ff698f019b8 16492->16494 16576 7ff698efb25c 16493->16576 16495 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16494->16495 16497 7ff698f019bf 16495->16497 16503 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16497->16503 16499 7ff698f01a63 16502 7ff698efb6b8 _wfindfirst32i64 17 API calls 16499->16502 16500 7ff698f019d8 16666 7ff698f082f4 16500->16666 16505 7ff698f01a77 16502->16505 16503->16467 16508 7ff698f01aa0 16505->16508 16515 7ff698f01ab0 16505->16515 16506 7ff698f01a20 16510 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16506->16510 16507 7ff698f019ff 16511 7ff698ef5cb4 _findclose 11 API calls 16507->16511 16509 7ff698ef5cb4 _findclose 11 API calls 16508->16509 16512 7ff698f01aa5 16509->16512 16510->16487 16513 7ff698f01a04 16511->16513 16516 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16513->16516 16514 7ff698f01d93 16518 7ff698ef5cb4 _findclose 11 API calls 16514->16518 16515->16514 16517 7ff698f01ad2 16515->16517 16516->16497 16519 7ff698f01aef 16517->16519 16585 7ff698f01ec4 16517->16585 16520 7ff698f01d98 16518->16520 16523 7ff698f01b63 16519->16523 16524 7ff698f01b17 16519->16524 16542 7ff698f01b57 16519->16542 16522 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16520->16522 16522->16512 16529 7ff698eff948 _findclose 11 API calls 16523->16529 16538 7ff698f01b26 16523->16538 16544 7ff698f01b8b 16523->16544 16685 7ff698efa4b0 16524->16685 16527 7ff698eff948 _findclose 11 API calls 16533 7ff698f01bad 16527->16533 16528 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16528->16512 16534 7ff698f01b7d 16529->16534 16531 7ff698f01b21 16536 7ff698ef5cb4 _findclose 11 API calls 16531->16536 16532 7ff698f01c33 16539 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16532->16539 16540 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16533->16540 16535 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16534->16535 16535->16544 16536->16538 16537 7ff698f01c86 16537->16538 16547 7ff698f0422c 40 API calls 16537->16547 16538->16528 16545 7ff698f01c3c 16539->16545 16540->16542 16541 7ff698f01b3f 16541->16542 16546 7ff698f01ec4 45 API calls 16541->16546 16542->16538 16543 7ff698f01c16 16542->16543 16691 7ff698f0809c 16542->16691 16543->16532 16543->16537 16544->16527 16544->16538 16544->16542 16550 7ff698f0422c 40 API calls 16545->16550 16552 7ff698f01c42 16545->16552 16546->16542 16548 7ff698f01cc4 16547->16548 16549 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16548->16549 16551 7ff698f01cce 16549->16551 16554 7ff698f01c6e 16550->16554 16551->16538 16551->16552 16553 7ff698f01d87 16552->16553 16557 7ff698eff948 _findclose 11 API calls 16552->16557 16555 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16553->16555 16556 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16554->16556 16555->16512 16556->16552 16558 7ff698f01d13 16557->16558 16559 7ff698f01d24 16558->16559 16560 7ff698f01d1b 16558->16560 16715 7ff698f01344 16559->16715 16561 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16560->16561 16563 7ff698f01d22 16561->16563 16570 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16563->16570 16565 7ff698f01d3a SetEnvironmentVariableW 16567 7ff698f01d7f 16565->16567 16568 7ff698f01d5e 16565->16568 16566 7ff698f01dc7 16569 7ff698efb6b8 _wfindfirst32i64 17 API calls 16566->16569 16571 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16567->16571 16572 7ff698ef5cb4 _findclose 11 API calls 16568->16572 16573 7ff698f01ddb 16569->16573 16570->16512 16571->16553 16574 7ff698f01d63 16572->16574 16575 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16574->16575 16575->16563 16577 7ff698efb273 16576->16577 16578 7ff698efb269 16576->16578 16579 7ff698ef5cb4 _findclose 11 API calls 16577->16579 16578->16577 16583 7ff698efb28e 16578->16583 16580 7ff698efb27a 16579->16580 16581 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16580->16581 16582 7ff698efb286 16581->16582 16582->16499 16582->16500 16583->16582 16584 7ff698ef5cb4 _findclose 11 API calls 16583->16584 16584->16580 16586 7ff698f01ee7 16585->16586 16587 7ff698f01f04 16585->16587 16586->16519 16587->16587 16588 7ff698eff948 _findclose 11 API calls 16587->16588 16595 7ff698f01f28 16588->16595 16589 7ff698f01fac 16590 7ff698efb2bc __CxxCallCatchBlock 45 API calls 16589->16590 16592 7ff698f01fb2 16590->16592 16591 7ff698f01f89 16593 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16591->16593 16593->16586 16594 7ff698eff948 _findclose 11 API calls 16594->16595 16595->16589 16595->16591 16595->16594 16596 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16595->16596 16597 7ff698f01344 _wfindfirst32i64 37 API calls 16595->16597 16598 7ff698f01f98 16595->16598 16596->16595 16597->16595 16599 7ff698efb6b8 _wfindfirst32i64 17 API calls 16598->16599 16599->16589 16601 7ff698f01df9 16600->16601 16602 7ff698f01e11 16600->16602 16601->16452 16602->16602 16603 7ff698eff948 _findclose 11 API calls 16602->16603 16610 7ff698f01e35 16603->16610 16604 7ff698f01eba 16606 7ff698efb2bc __CxxCallCatchBlock 45 API calls 16604->16606 16605 7ff698f01e96 16607 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16605->16607 16608 7ff698f01ec0 16606->16608 16607->16601 16609 7ff698eff948 _findclose 11 API calls 16609->16610 16610->16604 16610->16605 16610->16609 16611 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16610->16611 16612 7ff698efb25c __std_exception_copy 37 API calls 16610->16612 16613 7ff698f01ea5 16610->16613 16611->16610 16612->16610 16614 7ff698efb6b8 _wfindfirst32i64 17 API calls 16613->16614 16614->16604 16616 7ff698efa484 16615->16616 16620 7ff698efa48d 16615->16620 16616->16620 16724 7ff698ef9f4c 16616->16724 16620->16469 16620->16470 16622 7ff698f081e9 16621->16622 16623 7ff698f0738c 16621->16623 16625 7ff698ef5788 45 API calls 16622->16625 16624 7ff698f07399 16623->16624 16630 7ff698f073cf 16623->16630 16628 7ff698ef5cb4 _findclose 11 API calls 16624->16628 16637 7ff698f07340 16624->16637 16627 7ff698f0821d 16625->16627 16626 7ff698f073f9 16629 7ff698ef5cb4 _findclose 11 API calls 16626->16629 16633 7ff698f08233 16627->16633 16636 7ff698f08222 16627->16636 16639 7ff698f0824a 16627->16639 16631 7ff698f073a3 16628->16631 16632 7ff698f073fe 16629->16632 16630->16626 16634 7ff698f0741e 16630->16634 16635 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16631->16635 16638 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16632->16638 16640 7ff698ef5cb4 _findclose 11 API calls 16633->16640 16643 7ff698ef5788 45 API calls 16634->16643 16650 7ff698f07409 16634->16650 16641 7ff698f073ae 16635->16641 16636->16463 16637->16463 16638->16650 16644 7ff698f08266 16639->16644 16645 7ff698f08254 16639->16645 16642 7ff698f08238 16640->16642 16641->16463 16649 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16642->16649 16643->16650 16647 7ff698f08277 16644->16647 16648 7ff698f0828e 16644->16648 16646 7ff698ef5cb4 _findclose 11 API calls 16645->16646 16651 7ff698f08259 16646->16651 17010 7ff698f073dc 16647->17010 17019 7ff698f0a004 16648->17019 16649->16636 16650->16463 16654 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16651->16654 16654->16636 16656 7ff698ef5cb4 _findclose 11 API calls 16656->16636 16658 7ff698f0424e 16657->16658 16659 7ff698f0426b 16657->16659 16658->16659 16660 7ff698f0425c 16658->16660 16661 7ff698f04275 16659->16661 17059 7ff698f08ce8 16659->17059 16662 7ff698ef5cb4 _findclose 11 API calls 16660->16662 17066 7ff698f013ac 16661->17066 16665 7ff698f04261 __scrt_get_show_window_mode 16662->16665 16665->16488 16667 7ff698ef5788 45 API calls 16666->16667 16668 7ff698f0835a 16667->16668 16669 7ff698f08368 16668->16669 17078 7ff698effbd4 16668->17078 17081 7ff698ef5d74 16669->17081 16673 7ff698f08454 16676 7ff698f08465 16673->16676 16677 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16673->16677 16674 7ff698ef5788 45 API calls 16675 7ff698f083d7 16674->16675 16679 7ff698effbd4 5 API calls 16675->16679 16682 7ff698f083e0 16675->16682 16678 7ff698f019fb 16676->16678 16680 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16676->16680 16677->16676 16678->16506 16678->16507 16679->16682 16680->16678 16681 7ff698ef5d74 14 API calls 16683 7ff698f0843b 16681->16683 16682->16681 16683->16673 16684 7ff698f08443 SetEnvironmentVariableW 16683->16684 16684->16673 16686 7ff698efa4c9 16685->16686 16687 7ff698efa4c0 16685->16687 16686->16531 16686->16541 16687->16686 17108 7ff698ef9fc0 16687->17108 16692 7ff698f080a9 16691->16692 16696 7ff698f080d6 16691->16696 16693 7ff698f080ae 16692->16693 16692->16696 16694 7ff698ef5cb4 _findclose 11 API calls 16693->16694 16695 7ff698f080b3 16694->16695 16698 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16695->16698 16697 7ff698f0811a 16696->16697 16699 7ff698f08139 16696->16699 16713 7ff698f0810e __crtLCMapStringW 16696->16713 16700 7ff698ef5cb4 _findclose 11 API calls 16697->16700 16701 7ff698f080be 16698->16701 16702 7ff698f08143 16699->16702 16703 7ff698f08155 16699->16703 16704 7ff698f0811f 16700->16704 16701->16542 16705 7ff698ef5cb4 _findclose 11 API calls 16702->16705 16706 7ff698ef5788 45 API calls 16703->16706 16707 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16704->16707 16708 7ff698f08148 16705->16708 16709 7ff698f08162 16706->16709 16707->16713 16710 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16708->16710 16709->16713 17155 7ff698f09bc0 16709->17155 16710->16713 16713->16542 16714 7ff698ef5cb4 _findclose 11 API calls 16714->16713 16716 7ff698f01351 16715->16716 16717 7ff698f0135b 16715->16717 16716->16717 16722 7ff698f01377 16716->16722 16718 7ff698ef5cb4 _findclose 11 API calls 16717->16718 16719 7ff698f01363 16718->16719 16720 7ff698efb698 _invalid_parameter_noinfo 37 API calls 16719->16720 16721 7ff698f0136f 16720->16721 16721->16565 16721->16566 16722->16721 16723 7ff698ef5cb4 _findclose 11 API calls 16722->16723 16723->16719 16725 7ff698ef9f65 16724->16725 16738 7ff698ef9f61 16724->16738 16747 7ff698f03440 16725->16747 16730 7ff698ef9f83 16773 7ff698efa030 16730->16773 16731 7ff698ef9f77 16732 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16731->16732 16732->16738 16735 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16736 7ff698ef9faa 16735->16736 16737 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16736->16737 16737->16738 16738->16620 16739 7ff698efa2a0 16738->16739 16740 7ff698efa2e2 16739->16740 16741 7ff698efa2c9 16739->16741 16740->16741 16742 7ff698eff948 _findclose 11 API calls 16740->16742 16743 7ff698efa372 16740->16743 16744 7ff698f01640 WideCharToMultiByte 16740->16744 16746 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16740->16746 16741->16620 16742->16740 16745 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16743->16745 16744->16740 16745->16741 16746->16740 16748 7ff698f0344d 16747->16748 16749 7ff698ef9f6a 16747->16749 16792 7ff698efbfd4 16748->16792 16753 7ff698f0377c GetEnvironmentStringsW 16749->16753 16754 7ff698ef9f6f 16753->16754 16755 7ff698f037ac 16753->16755 16754->16730 16754->16731 16756 7ff698f01640 WideCharToMultiByte 16755->16756 16757 7ff698f037fd 16756->16757 16758 7ff698f03804 FreeEnvironmentStringsW 16757->16758 16759 7ff698efe3ac _fread_nolock 12 API calls 16757->16759 16758->16754 16760 7ff698f03817 16759->16760 16761 7ff698f0381f 16760->16761 16762 7ff698f03828 16760->16762 16763 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16761->16763 16764 7ff698f01640 WideCharToMultiByte 16762->16764 16765 7ff698f03826 16763->16765 16766 7ff698f0384b 16764->16766 16765->16758 16767 7ff698f0384f 16766->16767 16768 7ff698f03859 16766->16768 16769 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16767->16769 16770 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16768->16770 16771 7ff698f03857 FreeEnvironmentStringsW 16769->16771 16770->16771 16771->16754 16774 7ff698efa055 16773->16774 16775 7ff698eff948 _findclose 11 API calls 16774->16775 16786 7ff698efa08b 16775->16786 16776 7ff698efa093 16777 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16776->16777 16778 7ff698ef9f8b 16777->16778 16778->16735 16779 7ff698efa106 16780 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16779->16780 16780->16778 16781 7ff698eff948 _findclose 11 API calls 16781->16786 16782 7ff698efa0f5 17004 7ff698efa25c 16782->17004 16784 7ff698efb25c __std_exception_copy 37 API calls 16784->16786 16786->16776 16786->16779 16786->16781 16786->16782 16786->16784 16787 7ff698efa12b 16786->16787 16789 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16786->16789 16790 7ff698efb6b8 _wfindfirst32i64 17 API calls 16787->16790 16788 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16788->16776 16789->16786 16791 7ff698efa13e 16790->16791 16793 7ff698efbfe5 FlsGetValue 16792->16793 16794 7ff698efc000 FlsSetValue 16792->16794 16795 7ff698efbff2 16793->16795 16797 7ff698efbffa 16793->16797 16794->16795 16796 7ff698efc00d 16794->16796 16799 7ff698efbff8 16795->16799 16800 7ff698efb2bc __CxxCallCatchBlock 45 API calls 16795->16800 16798 7ff698eff948 _findclose 11 API calls 16796->16798 16797->16794 16802 7ff698efc01c 16798->16802 16812 7ff698f03114 16799->16812 16801 7ff698efc075 16800->16801 16803 7ff698efc03a FlsSetValue 16802->16803 16804 7ff698efc02a FlsSetValue 16802->16804 16806 7ff698efc058 16803->16806 16807 7ff698efc046 FlsSetValue 16803->16807 16805 7ff698efc033 16804->16805 16808 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16805->16808 16809 7ff698efbcac _findclose 11 API calls 16806->16809 16807->16805 16808->16795 16810 7ff698efc060 16809->16810 16811 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16810->16811 16811->16799 16835 7ff698f03384 16812->16835 16814 7ff698f03149 16850 7ff698f02e14 16814->16850 16817 7ff698f03166 16817->16749 16818 7ff698efe3ac _fread_nolock 12 API calls 16819 7ff698f03177 16818->16819 16820 7ff698f0317f 16819->16820 16822 7ff698f0318e 16819->16822 16821 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16820->16821 16821->16817 16822->16822 16857 7ff698f034bc 16822->16857 16825 7ff698f0328a 16826 7ff698ef5cb4 _findclose 11 API calls 16825->16826 16828 7ff698f0328f 16826->16828 16827 7ff698f032e5 16830 7ff698f0334c 16827->16830 16868 7ff698f02c44 16827->16868 16831 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16828->16831 16829 7ff698f032a4 16829->16827 16832 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16829->16832 16834 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16830->16834 16831->16817 16832->16827 16834->16817 16836 7ff698f033a7 16835->16836 16837 7ff698f033b1 16836->16837 16883 7ff698f011a8 EnterCriticalSection 16836->16883 16839 7ff698f03423 16837->16839 16841 7ff698efb2bc __CxxCallCatchBlock 45 API calls 16837->16841 16839->16814 16844 7ff698f0343b 16841->16844 16845 7ff698f03492 16844->16845 16847 7ff698efbfd4 50 API calls 16844->16847 16845->16814 16848 7ff698f0347c 16847->16848 16849 7ff698f03114 65 API calls 16848->16849 16849->16845 16884 7ff698ef5788 16850->16884 16853 7ff698f02e34 GetOEMCP 16856 7ff698f02e5b 16853->16856 16854 7ff698f02e46 16855 7ff698f02e4b GetACP 16854->16855 16854->16856 16855->16856 16856->16817 16856->16818 16858 7ff698f02e14 47 API calls 16857->16858 16859 7ff698f034e9 16858->16859 16860 7ff698f0363f 16859->16860 16862 7ff698f03526 IsValidCodePage 16859->16862 16867 7ff698f03540 __scrt_get_show_window_mode 16859->16867 16861 7ff698eec010 _wfindfirst32i64 8 API calls 16860->16861 16863 7ff698f03281 16861->16863 16862->16860 16864 7ff698f03537 16862->16864 16863->16825 16863->16829 16865 7ff698f03566 GetCPInfo 16864->16865 16864->16867 16865->16860 16865->16867 16916 7ff698f02f2c 16867->16916 17003 7ff698f011a8 EnterCriticalSection 16868->17003 16885 7ff698ef57ac 16884->16885 16886 7ff698ef57a7 16884->16886 16885->16886 16887 7ff698efbf00 __CxxCallCatchBlock 45 API calls 16885->16887 16886->16853 16886->16854 16888 7ff698ef57c7 16887->16888 16892 7ff698efe734 16888->16892 16893 7ff698ef57ea 16892->16893 16894 7ff698efe749 16892->16894 16896 7ff698efe7a0 16893->16896 16894->16893 16900 7ff698f04154 16894->16900 16897 7ff698efe7b5 16896->16897 16898 7ff698efe7c8 16896->16898 16897->16898 16913 7ff698f034a0 16897->16913 16898->16886 16901 7ff698efbf00 __CxxCallCatchBlock 45 API calls 16900->16901 16902 7ff698f04163 16901->16902 16903 7ff698f041ae 16902->16903 16912 7ff698f011a8 EnterCriticalSection 16902->16912 16903->16893 16914 7ff698efbf00 __CxxCallCatchBlock 45 API calls 16913->16914 16915 7ff698f034a9 16914->16915 16917 7ff698f02f69 GetCPInfo 16916->16917 16918 7ff698f0305f 16916->16918 16917->16918 16919 7ff698f02f7c 16917->16919 16920 7ff698eec010 _wfindfirst32i64 8 API calls 16918->16920 16927 7ff698f03c90 16919->16927 16922 7ff698f030fe 16920->16922 16922->16860 16928 7ff698ef5788 45 API calls 16927->16928 16929 7ff698f03cd2 16928->16929 16947 7ff698f003f0 16929->16947 16949 7ff698f003f9 MultiByteToWideChar 16947->16949 17005 7ff698efa0fd 17004->17005 17006 7ff698efa261 17004->17006 17005->16788 17007 7ff698efa28a 17006->17007 17009 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17006->17009 17008 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17007->17008 17008->17005 17009->17006 17011 7ff698f07410 17010->17011 17012 7ff698f073f9 17010->17012 17011->17012 17015 7ff698f0741e 17011->17015 17013 7ff698ef5cb4 _findclose 11 API calls 17012->17013 17014 7ff698f073fe 17013->17014 17016 7ff698efb698 _invalid_parameter_noinfo 37 API calls 17014->17016 17017 7ff698ef5788 45 API calls 17015->17017 17018 7ff698f07409 17015->17018 17016->17018 17017->17018 17018->16636 17020 7ff698ef5788 45 API calls 17019->17020 17021 7ff698f0a029 17020->17021 17024 7ff698f09c80 17021->17024 17027 7ff698f09cce 17024->17027 17025 7ff698eec010 _wfindfirst32i64 8 API calls 17026 7ff698f082b5 17025->17026 17026->16636 17026->16656 17028 7ff698f09d55 17027->17028 17030 7ff698f09d40 GetCPInfo 17027->17030 17033 7ff698f09d59 17027->17033 17029 7ff698f003f0 _fread_nolock MultiByteToWideChar 17028->17029 17028->17033 17031 7ff698f09ded 17029->17031 17030->17028 17030->17033 17032 7ff698efe3ac _fread_nolock 12 API calls 17031->17032 17031->17033 17034 7ff698f09e24 17031->17034 17032->17034 17033->17025 17034->17033 17035 7ff698f003f0 _fread_nolock MultiByteToWideChar 17034->17035 17036 7ff698f09e92 17035->17036 17037 7ff698f09f74 17036->17037 17038 7ff698f003f0 _fread_nolock MultiByteToWideChar 17036->17038 17037->17033 17039 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17037->17039 17040 7ff698f09eb8 17038->17040 17039->17033 17040->17037 17041 7ff698efe3ac _fread_nolock 12 API calls 17040->17041 17042 7ff698f09ee5 17040->17042 17041->17042 17042->17037 17043 7ff698f003f0 _fread_nolock MultiByteToWideChar 17042->17043 17044 7ff698f09f5c 17043->17044 17045 7ff698f09f7c 17044->17045 17046 7ff698f09f62 17044->17046 17053 7ff698effc18 17045->17053 17046->17037 17048 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17046->17048 17048->17037 17050 7ff698f09fbb 17050->17033 17052 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17050->17052 17051 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17051->17050 17052->17033 17054 7ff698eff9c0 __crtLCMapStringW 5 API calls 17053->17054 17055 7ff698effc56 17054->17055 17056 7ff698effc5e 17055->17056 17057 7ff698effe80 __crtLCMapStringW 5 API calls 17055->17057 17056->17050 17056->17051 17058 7ff698effcc7 CompareStringW 17057->17058 17058->17056 17060 7ff698f08d0a HeapSize 17059->17060 17061 7ff698f08cf1 17059->17061 17062 7ff698ef5cb4 _findclose 11 API calls 17061->17062 17063 7ff698f08cf6 17062->17063 17064 7ff698efb698 _invalid_parameter_noinfo 37 API calls 17063->17064 17065 7ff698f08d01 17064->17065 17065->16661 17067 7ff698f013c1 17066->17067 17068 7ff698f013cb 17066->17068 17069 7ff698efe3ac _fread_nolock 12 API calls 17067->17069 17070 7ff698f013d0 17068->17070 17076 7ff698f013d7 _findclose 17068->17076 17075 7ff698f013c9 17069->17075 17073 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17070->17073 17071 7ff698f013dd 17074 7ff698ef5cb4 _findclose 11 API calls 17071->17074 17072 7ff698f0140a HeapReAlloc 17072->17075 17072->17076 17073->17075 17074->17075 17075->16665 17076->17071 17076->17072 17077 7ff698f043e0 _findclose 2 API calls 17076->17077 17077->17076 17079 7ff698eff9c0 __crtLCMapStringW 5 API calls 17078->17079 17080 7ff698effbf4 17079->17080 17080->16669 17082 7ff698ef5dc2 17081->17082 17083 7ff698ef5d9e 17081->17083 17084 7ff698ef5e1c 17082->17084 17085 7ff698ef5dc7 17082->17085 17087 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17083->17087 17090 7ff698ef5dad 17083->17090 17086 7ff698f003f0 _fread_nolock MultiByteToWideChar 17084->17086 17088 7ff698ef5ddc 17085->17088 17085->17090 17091 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17085->17091 17097 7ff698ef5e38 17086->17097 17087->17090 17092 7ff698efe3ac _fread_nolock 12 API calls 17088->17092 17089 7ff698ef5e3f GetLastError 17103 7ff698ef5c28 17089->17103 17090->16673 17090->16674 17091->17088 17092->17090 17094 7ff698ef5e7a 17094->17090 17095 7ff698f003f0 _fread_nolock MultiByteToWideChar 17094->17095 17099 7ff698ef5ebe 17095->17099 17097->17089 17097->17094 17098 7ff698ef5e6d 17097->17098 17101 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17097->17101 17102 7ff698efe3ac _fread_nolock 12 API calls 17098->17102 17099->17089 17099->17090 17100 7ff698ef5cb4 _findclose 11 API calls 17100->17090 17101->17098 17102->17094 17104 7ff698efc078 _findclose 11 API calls 17103->17104 17105 7ff698ef5c35 Concurrency::details::SchedulerProxy::DeleteThis 17104->17105 17106 7ff698efc078 _findclose 11 API calls 17105->17106 17107 7ff698ef5c57 17106->17107 17107->17100 17109 7ff698ef9fd9 17108->17109 17117 7ff698ef9fd5 17108->17117 17129 7ff698f0388c GetEnvironmentStringsW 17109->17129 17112 7ff698ef9ff2 17136 7ff698efa140 17112->17136 17113 7ff698ef9fe6 17114 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17113->17114 17114->17117 17117->16686 17121 7ff698efa380 17117->17121 17118 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17119 7ff698efa019 17118->17119 17120 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17119->17120 17120->17117 17122 7ff698efa3a3 17121->17122 17125 7ff698efa3ba 17121->17125 17122->16686 17123 7ff698f003f0 MultiByteToWideChar _fread_nolock 17123->17125 17124 7ff698eff948 _findclose 11 API calls 17124->17125 17125->17122 17125->17123 17125->17124 17126 7ff698efa42e 17125->17126 17128 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17125->17128 17127 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17126->17127 17127->17122 17128->17125 17130 7ff698ef9fde 17129->17130 17131 7ff698f038b0 17129->17131 17130->17112 17130->17113 17132 7ff698efe3ac _fread_nolock 12 API calls 17131->17132 17133 7ff698f038e7 memcpy_s 17132->17133 17134 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17133->17134 17135 7ff698f03907 FreeEnvironmentStringsW 17134->17135 17135->17130 17137 7ff698efa168 17136->17137 17138 7ff698eff948 _findclose 11 API calls 17137->17138 17145 7ff698efa1a3 17138->17145 17139 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17140 7ff698ef9ffa 17139->17140 17140->17118 17141 7ff698efa225 17142 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17141->17142 17142->17140 17143 7ff698eff948 _findclose 11 API calls 17143->17145 17144 7ff698efa214 17146 7ff698efa25c 11 API calls 17144->17146 17145->17141 17145->17143 17145->17144 17147 7ff698f01344 _wfindfirst32i64 37 API calls 17145->17147 17150 7ff698efa248 17145->17150 17151 7ff698efa1ab 17145->17151 17153 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17145->17153 17148 7ff698efa21c 17146->17148 17147->17145 17149 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17148->17149 17149->17151 17152 7ff698efb6b8 _wfindfirst32i64 17 API calls 17150->17152 17151->17139 17154 7ff698efa25a 17152->17154 17153->17145 17156 7ff698f09be9 __crtLCMapStringW 17155->17156 17157 7ff698f0819e 17156->17157 17158 7ff698effc18 6 API calls 17156->17158 17157->16713 17157->16714 17158->17157 16223 7ff698efa715 16235 7ff698efb188 16223->16235 16240 7ff698efbf00 GetLastError 16235->16240 16241 7ff698efbf24 FlsGetValue 16240->16241 16242 7ff698efbf41 FlsSetValue 16240->16242 16243 7ff698efbf3b 16241->16243 16259 7ff698efbf31 SetLastError 16241->16259 16244 7ff698efbf53 16242->16244 16242->16259 16243->16242 16271 7ff698eff948 16244->16271 16247 7ff698efbfcd 16250 7ff698efb2bc __CxxCallCatchBlock 38 API calls 16247->16250 16248 7ff698efb191 16262 7ff698efb2bc 16248->16262 16256 7ff698efbfd2 16250->16256 16251 7ff698efbf80 FlsSetValue 16254 7ff698efbf9e 16251->16254 16255 7ff698efbf8c FlsSetValue 16251->16255 16252 7ff698efbf70 FlsSetValue 16253 7ff698efbf79 16252->16253 16278 7ff698efb700 16253->16278 16284 7ff698efbcac 16254->16284 16255->16253 16259->16247 16259->16248 16332 7ff698f044a0 16262->16332 16276 7ff698eff959 _findclose 16271->16276 16272 7ff698eff9aa 16292 7ff698ef5cb4 16272->16292 16273 7ff698eff98e RtlAllocateHeap 16274 7ff698efbf62 16273->16274 16273->16276 16274->16251 16274->16252 16276->16272 16276->16273 16289 7ff698f043e0 16276->16289 16279 7ff698efb705 RtlRestoreThreadPreferredUILanguages 16278->16279 16281 7ff698efb734 16278->16281 16280 7ff698efb720 GetLastError 16279->16280 16279->16281 16282 7ff698efb72d Concurrency::details::SchedulerProxy::DeleteThis 16280->16282 16281->16259 16283 7ff698ef5cb4 _findclose 9 API calls 16282->16283 16283->16281 16318 7ff698efbb84 16284->16318 16295 7ff698f04420 16289->16295 16301 7ff698efc078 GetLastError 16292->16301 16294 7ff698ef5cbd 16294->16274 16300 7ff698f011a8 EnterCriticalSection 16295->16300 16302 7ff698efc0b9 FlsSetValue 16301->16302 16306 7ff698efc09c 16301->16306 16303 7ff698efc0cb 16302->16303 16315 7ff698efc0a9 16302->16315 16305 7ff698eff948 _findclose 5 API calls 16303->16305 16304 7ff698efc125 SetLastError 16304->16294 16307 7ff698efc0da 16305->16307 16306->16302 16306->16315 16308 7ff698efc0f8 FlsSetValue 16307->16308 16309 7ff698efc0e8 FlsSetValue 16307->16309 16311 7ff698efc104 FlsSetValue 16308->16311 16312 7ff698efc116 16308->16312 16310 7ff698efc0f1 16309->16310 16313 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 16310->16313 16311->16310 16314 7ff698efbcac _findclose 5 API calls 16312->16314 16313->16315 16316 7ff698efc11e 16314->16316 16315->16304 16317 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 16316->16317 16317->16304 16330 7ff698f011a8 EnterCriticalSection 16318->16330 16366 7ff698f04458 16332->16366 16371 7ff698f011a8 EnterCriticalSection 16366->16371 20634 7ff698ef5b00 20635 7ff698ef5b0b 20634->20635 20643 7ff698efff54 20635->20643 20656 7ff698f011a8 EnterCriticalSection 20643->20656 20509 7ff698efbd80 20510 7ff698efbd85 20509->20510 20511 7ff698efbd9a 20509->20511 20515 7ff698efbda0 20510->20515 20516 7ff698efbde2 20515->20516 20517 7ff698efbdea 20515->20517 20518 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20516->20518 20519 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20517->20519 20518->20517 20520 7ff698efbdf7 20519->20520 20521 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20520->20521 20522 7ff698efbe04 20521->20522 20523 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20522->20523 20524 7ff698efbe11 20523->20524 20525 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20524->20525 20526 7ff698efbe1e 20525->20526 20527 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20526->20527 20528 7ff698efbe2b 20527->20528 20529 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20528->20529 20530 7ff698efbe38 20529->20530 20531 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20530->20531 20532 7ff698efbe45 20531->20532 20533 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20532->20533 20534 7ff698efbe55 20533->20534 20535 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20534->20535 20536 7ff698efbe65 20535->20536 20541 7ff698efbc4c 20536->20541 20555 7ff698f011a8 EnterCriticalSection 20541->20555 20657 7ff698efab00 20660 7ff698efaa80 20657->20660 20667 7ff698f011a8 EnterCriticalSection 20660->20667 20668 7ff698f02500 20679 7ff698f08494 20668->20679 20680 7ff698f084a1 20679->20680 20681 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20680->20681 20682 7ff698f084bd 20680->20682 20681->20680 20683 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20682->20683 20684 7ff698f02509 20682->20684 20683->20682 20685 7ff698f011a8 EnterCriticalSection 20684->20685 17159 7ff698ef8670 17160 7ff698ef869e 17159->17160 17161 7ff698ef86d7 17159->17161 17162 7ff698ef5cb4 _findclose 11 API calls 17160->17162 17161->17160 17163 7ff698ef86dc FindFirstFileExW 17161->17163 17164 7ff698ef86a3 17162->17164 17165 7ff698ef8745 17163->17165 17166 7ff698ef86fe GetLastError 17163->17166 17167 7ff698efb698 _invalid_parameter_noinfo 37 API calls 17164->17167 17219 7ff698ef88e0 17165->17219 17169 7ff698ef8735 17166->17169 17170 7ff698ef8709 17166->17170 17171 7ff698ef86ae 17167->17171 17172 7ff698ef5cb4 _findclose 11 API calls 17169->17172 17170->17169 17174 7ff698ef8725 17170->17174 17175 7ff698ef8713 17170->17175 17179 7ff698eec010 _wfindfirst32i64 8 API calls 17171->17179 17172->17171 17178 7ff698ef5cb4 _findclose 11 API calls 17174->17178 17175->17169 17177 7ff698ef8718 17175->17177 17176 7ff698ef88e0 _wfindfirst32i64 10 API calls 17180 7ff698ef876b 17176->17180 17181 7ff698ef5cb4 _findclose 11 API calls 17177->17181 17178->17171 17182 7ff698ef86c2 17179->17182 17183 7ff698ef88e0 _wfindfirst32i64 10 API calls 17180->17183 17181->17171 17184 7ff698ef8779 17183->17184 17185 7ff698f01344 _wfindfirst32i64 37 API calls 17184->17185 17186 7ff698ef8797 17185->17186 17186->17171 17187 7ff698ef87a3 17186->17187 17188 7ff698efb6b8 _wfindfirst32i64 17 API calls 17187->17188 17190 7ff698ef87b7 17188->17190 17189 7ff698ef87e1 17191 7ff698ef5cb4 _findclose 11 API calls 17189->17191 17190->17189 17192 7ff698ef8820 FindNextFileW 17190->17192 17193 7ff698ef87e6 17191->17193 17194 7ff698ef8870 17192->17194 17195 7ff698ef882f GetLastError 17192->17195 17196 7ff698efb698 _invalid_parameter_noinfo 37 API calls 17193->17196 17197 7ff698ef88e0 _wfindfirst32i64 10 API calls 17194->17197 17198 7ff698ef8863 17195->17198 17199 7ff698ef883a 17195->17199 17200 7ff698ef87f1 17196->17200 17201 7ff698ef8888 17197->17201 17202 7ff698ef5cb4 _findclose 11 API calls 17198->17202 17199->17198 17204 7ff698ef8844 17199->17204 17205 7ff698ef8856 17199->17205 17206 7ff698eec010 _wfindfirst32i64 8 API calls 17200->17206 17203 7ff698ef88e0 _wfindfirst32i64 10 API calls 17201->17203 17202->17200 17207 7ff698ef8896 17203->17207 17204->17198 17208 7ff698ef8849 17204->17208 17209 7ff698ef5cb4 _findclose 11 API calls 17205->17209 17210 7ff698ef8804 17206->17210 17211 7ff698ef88e0 _wfindfirst32i64 10 API calls 17207->17211 17212 7ff698ef5cb4 _findclose 11 API calls 17208->17212 17209->17200 17213 7ff698ef88a4 17211->17213 17212->17200 17214 7ff698f01344 _wfindfirst32i64 37 API calls 17213->17214 17215 7ff698ef88c2 17214->17215 17215->17200 17216 7ff698ef88ca 17215->17216 17217 7ff698efb6b8 _wfindfirst32i64 17 API calls 17216->17217 17218 7ff698ef88de 17217->17218 17220 7ff698ef88fe FileTimeToSystemTime 17219->17220 17221 7ff698ef88f8 17219->17221 17222 7ff698ef890d SystemTimeToTzSpecificLocalTime 17220->17222 17223 7ff698ef8923 17220->17223 17221->17220 17221->17223 17222->17223 17224 7ff698eec010 _wfindfirst32i64 8 API calls 17223->17224 17225 7ff698ef875d 17224->17225 17225->17176 20745 7ff698eec2e0 20746 7ff698eec2f0 20745->20746 20762 7ff698efa95c 20746->20762 20748 7ff698eec2fc 20768 7ff698eec5d8 20748->20768 20750 7ff698eec314 _RTC_Initialize 20760 7ff698eec369 20750->20760 20773 7ff698eec788 20750->20773 20751 7ff698eec8bc 7 API calls 20752 7ff698eec395 20751->20752 20754 7ff698eec329 20776 7ff698ef9dc8 20754->20776 20760->20751 20761 7ff698eec385 20760->20761 20763 7ff698efa96d 20762->20763 20764 7ff698efa975 20763->20764 20765 7ff698ef5cb4 _findclose 11 API calls 20763->20765 20764->20748 20766 7ff698efa984 20765->20766 20767 7ff698efb698 _invalid_parameter_noinfo 37 API calls 20766->20767 20767->20764 20769 7ff698eec5e9 20768->20769 20772 7ff698eec5ee __scrt_acquire_startup_lock 20768->20772 20770 7ff698eec8bc 7 API calls 20769->20770 20769->20772 20771 7ff698eec662 20770->20771 20772->20750 20801 7ff698eec74c 20773->20801 20775 7ff698eec791 20775->20754 20777 7ff698ef9de8 20776->20777 20778 7ff698eec335 20776->20778 20779 7ff698ef9df0 20777->20779 20780 7ff698ef9e06 GetModuleFileNameW 20777->20780 20778->20760 20800 7ff698eec85c InitializeSListHead 20778->20800 20781 7ff698ef5cb4 _findclose 11 API calls 20779->20781 20784 7ff698ef9e31 20780->20784 20782 7ff698ef9df5 20781->20782 20783 7ff698efb698 _invalid_parameter_noinfo 37 API calls 20782->20783 20783->20778 20816 7ff698ef9d68 20784->20816 20787 7ff698ef9e79 20788 7ff698ef5cb4 _findclose 11 API calls 20787->20788 20789 7ff698ef9e7e 20788->20789 20790 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20789->20790 20790->20778 20791 7ff698ef9eb3 20793 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20791->20793 20792 7ff698ef9e91 20792->20791 20794 7ff698ef9edf 20792->20794 20795 7ff698ef9ef8 20792->20795 20793->20778 20796 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20794->20796 20797 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20795->20797 20798 7ff698ef9ee8 20796->20798 20797->20791 20799 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20798->20799 20799->20778 20802 7ff698eec766 20801->20802 20804 7ff698eec75f 20801->20804 20805 7ff698efaf9c 20802->20805 20804->20775 20808 7ff698efabd8 20805->20808 20815 7ff698f011a8 EnterCriticalSection 20808->20815 20817 7ff698ef9d80 20816->20817 20821 7ff698ef9db8 20816->20821 20818 7ff698eff948 _findclose 11 API calls 20817->20818 20817->20821 20819 7ff698ef9dae 20818->20819 20820 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 20819->20820 20820->20821 20821->20787 20821->20792 20170 7ff698f0bc8e 20171 7ff698f0bc9e 20170->20171 20174 7ff698ef5b68 LeaveCriticalSection 20171->20174 20040 7ff698f004dc 20041 7ff698f006ce 20040->20041 20044 7ff698f0051e _isindst 20040->20044 20042 7ff698ef5cb4 _findclose 11 API calls 20041->20042 20060 7ff698f006be 20042->20060 20043 7ff698eec010 _wfindfirst32i64 8 API calls 20045 7ff698f006e9 20043->20045 20044->20041 20046 7ff698f0059e _isindst 20044->20046 20061 7ff698f070e4 20046->20061 20051 7ff698f006fa 20053 7ff698efb6b8 _wfindfirst32i64 17 API calls 20051->20053 20055 7ff698f0070e 20053->20055 20058 7ff698f005fb 20058->20060 20085 7ff698f07128 20058->20085 20060->20043 20062 7ff698f070f3 20061->20062 20063 7ff698f005bc 20061->20063 20092 7ff698f011a8 EnterCriticalSection 20062->20092 20067 7ff698f064e8 20063->20067 20068 7ff698f064f1 20067->20068 20069 7ff698f005d1 20067->20069 20070 7ff698ef5cb4 _findclose 11 API calls 20068->20070 20069->20051 20073 7ff698f06518 20069->20073 20071 7ff698f064f6 20070->20071 20072 7ff698efb698 _invalid_parameter_noinfo 37 API calls 20071->20072 20072->20069 20074 7ff698f06521 20073->20074 20075 7ff698f005e2 20073->20075 20076 7ff698ef5cb4 _findclose 11 API calls 20074->20076 20075->20051 20079 7ff698f06548 20075->20079 20077 7ff698f06526 20076->20077 20078 7ff698efb698 _invalid_parameter_noinfo 37 API calls 20077->20078 20078->20075 20080 7ff698f06551 20079->20080 20081 7ff698f005f3 20079->20081 20082 7ff698ef5cb4 _findclose 11 API calls 20080->20082 20081->20051 20081->20058 20083 7ff698f06556 20082->20083 20084 7ff698efb698 _invalid_parameter_noinfo 37 API calls 20083->20084 20084->20081 20093 7ff698f011a8 EnterCriticalSection 20085->20093 20982 7ff698f0be14 20985 7ff698ef5b68 LeaveCriticalSection 20982->20985 20831 7ff698efd2d0 20842 7ff698f011a8 EnterCriticalSection 20831->20842 17226 7ff698eec3cc 17247 7ff698eec59c 17226->17247 17229 7ff698eec518 17351 7ff698eec8bc IsProcessorFeaturePresent 17229->17351 17230 7ff698eec3e8 __scrt_acquire_startup_lock 17232 7ff698eec522 17230->17232 17237 7ff698eec406 __scrt_release_startup_lock 17230->17237 17233 7ff698eec8bc 7 API calls 17232->17233 17235 7ff698eec52d __CxxCallCatchBlock 17233->17235 17234 7ff698eec42b 17236 7ff698eec4b1 17253 7ff698eeca04 17236->17253 17237->17234 17237->17236 17340 7ff698efa8e0 17237->17340 17240 7ff698eec4b6 17256 7ff698ee1000 17240->17256 17244 7ff698eec4d9 17244->17235 17347 7ff698eec720 17244->17347 17248 7ff698eec5a4 17247->17248 17249 7ff698eec5b0 __scrt_dllmain_crt_thread_attach 17248->17249 17250 7ff698eec5bd 17249->17250 17252 7ff698eec3e0 17249->17252 17250->17252 17358 7ff698eed1c0 17250->17358 17252->17229 17252->17230 17385 7ff698f0b580 17253->17385 17255 7ff698eeca1b GetStartupInfoW 17255->17240 17257 7ff698ee100b 17256->17257 17387 7ff698ee89b0 17257->17387 17259 7ff698ee101d 17394 7ff698ef66e8 17259->17394 17261 7ff698ee39ab 17401 7ff698ee1ea0 17261->17401 17265 7ff698eec010 _wfindfirst32i64 8 API calls 17266 7ff698ee3b73 17265->17266 17345 7ff698eeca48 GetModuleHandleW 17266->17345 17267 7ff698ee39ca 17309 7ff698ee3ab2 17267->17309 17426 7ff698ee7d70 17267->17426 17269 7ff698ee39ff 17270 7ff698ee3a4b 17269->17270 17272 7ff698ee7d70 61 API calls 17269->17272 17441 7ff698ee8250 17270->17441 17276 7ff698ee3a20 __std_exception_destroy 17272->17276 17273 7ff698ee3a60 17445 7ff698ee1ca0 17273->17445 17276->17270 17280 7ff698ee8250 58 API calls 17276->17280 17277 7ff698ee3b2d 17279 7ff698ee3b8d 17277->17279 17464 7ff698ee8b80 17277->17464 17278 7ff698ee1ca0 121 API calls 17281 7ff698ee3a96 17278->17281 17286 7ff698ee3bdb 17279->17286 17279->17309 17488 7ff698ee8de0 17279->17488 17280->17270 17284 7ff698ee3a9a 17281->17284 17285 7ff698ee3ab7 17281->17285 17564 7ff698ee2b10 17284->17564 17285->17277 17577 7ff698ee4060 17285->17577 17502 7ff698ee6ff0 17286->17502 17288 7ff698ee3bc0 17292 7ff698ee3b53 17288->17292 17293 7ff698ee3bce SetDllDirectoryW 17288->17293 17298 7ff698ee2b10 59 API calls 17292->17298 17293->17286 17296 7ff698ee3c27 17303 7ff698ee3d11 17296->17303 17307 7ff698ee3c46 17296->17307 17298->17309 17301 7ff698ee3bf5 17301->17296 17609 7ff698ee6800 17301->17609 17302 7ff698ee3b03 17302->17277 17306 7ff698ee3b08 17302->17306 17506 7ff698ee34a0 17303->17506 17304 7ff698ee2b10 59 API calls 17304->17309 17596 7ff698ef097c 17306->17596 17323 7ff698ee3c88 17307->17323 17645 7ff698ee1ee0 17307->17645 17309->17265 17313 7ff698ee3ad5 17313->17304 17314 7ff698ee3c29 17318 7ff698ee6a50 FreeLibrary 17314->17318 17316 7ff698ee3cdc 17649 7ff698ee3440 17316->17649 17317 7ff698ee3cb9 PostMessageW GetMessageW 17317->17316 17318->17296 17322 7ff698ee3d2b 17514 7ff698ee81e0 17322->17514 17323->17309 17323->17316 17323->17317 17324 7ff698ee3c18 17327 7ff698ee3d3e 17329 7ff698ee7d70 61 API calls 17327->17329 17331 7ff698ee3d4a 17329->17331 17330 7ff698ee3cec 17332 7ff698ee6a50 FreeLibrary 17330->17332 17333 7ff698ee3d7a 17331->17333 17334 7ff698ee3d57 PostMessageW GetMessageW 17331->17334 17332->17309 17521 7ff698ee8290 17333->17521 17334->17333 17341 7ff698efa918 17340->17341 17342 7ff698efa8f7 17340->17342 17343 7ff698efb188 45 API calls 17341->17343 17342->17236 17344 7ff698efa91d 17343->17344 17346 7ff698eeca59 17345->17346 17346->17244 17348 7ff698eec731 17347->17348 17349 7ff698eec4f0 17348->17349 17350 7ff698eed1c0 7 API calls 17348->17350 17349->17234 17350->17349 17352 7ff698eec8e2 _wfindfirst32i64 __scrt_get_show_window_mode 17351->17352 17353 7ff698eec901 RtlCaptureContext RtlLookupFunctionEntry 17352->17353 17354 7ff698eec92a RtlVirtualUnwind 17353->17354 17355 7ff698eec966 __scrt_get_show_window_mode 17353->17355 17354->17355 17356 7ff698eec998 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17355->17356 17357 7ff698eec9e6 _wfindfirst32i64 17356->17357 17357->17232 17359 7ff698eed1d2 17358->17359 17360 7ff698eed1c8 17358->17360 17359->17252 17364 7ff698eed564 17360->17364 17365 7ff698eed573 17364->17365 17366 7ff698eed1cd 17364->17366 17372 7ff698eee560 17365->17372 17368 7ff698eed5d0 17366->17368 17369 7ff698eed5fb 17368->17369 17370 7ff698eed5de DeleteCriticalSection 17369->17370 17371 7ff698eed5ff 17369->17371 17370->17369 17371->17359 17376 7ff698eee3c8 17372->17376 17377 7ff698eee4b2 TlsFree 17376->17377 17383 7ff698eee40c __vcrt_FlsAlloc 17376->17383 17378 7ff698eee43a LoadLibraryExW 17380 7ff698eee45b GetLastError 17378->17380 17381 7ff698eee4d9 17378->17381 17379 7ff698eee4f9 GetProcAddress 17379->17377 17380->17383 17381->17379 17382 7ff698eee4f0 FreeLibrary 17381->17382 17382->17379 17383->17377 17383->17378 17383->17379 17384 7ff698eee47d LoadLibraryExW 17383->17384 17384->17381 17384->17383 17386 7ff698f0b570 17385->17386 17386->17255 17386->17386 17389 7ff698ee89cf 17387->17389 17388 7ff698ee8a20 WideCharToMultiByte 17388->17389 17391 7ff698ee8ac6 17388->17391 17389->17388 17390 7ff698ee8a74 WideCharToMultiByte 17389->17390 17389->17391 17393 7ff698ee89d7 __std_exception_destroy 17389->17393 17390->17389 17390->17391 17683 7ff698ee29c0 17391->17683 17393->17259 17397 7ff698f00840 17394->17397 17395 7ff698f00893 17396 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17395->17396 17400 7ff698f008bc 17396->17400 17397->17395 17398 7ff698f008e6 17397->17398 18014 7ff698f00718 17398->18014 17400->17261 17402 7ff698ee1eb5 17401->17402 17404 7ff698ee1ed0 17402->17404 18022 7ff698ee2870 17402->18022 17404->17309 17405 7ff698ee3f00 17404->17405 17406 7ff698eebfb0 17405->17406 17407 7ff698ee3f0c GetModuleFileNameW 17406->17407 17408 7ff698ee3f55 17407->17408 17409 7ff698ee3f3e 17407->17409 18062 7ff698ee8ef0 17408->18062 17411 7ff698ee29c0 57 API calls 17409->17411 17413 7ff698ee3f51 17411->17413 17416 7ff698eec010 _wfindfirst32i64 8 API calls 17413->17416 17414 7ff698ee3f80 18073 7ff698ee40e0 17414->18073 17415 7ff698ee3f70 17417 7ff698ee2b10 59 API calls 17415->17417 17419 7ff698ee3fd9 17416->17419 17417->17413 17419->17267 17421 7ff698ee1ee0 49 API calls 17422 7ff698ee3fa5 17421->17422 17422->17413 17423 7ff698ee3fac 17422->17423 18081 7ff698ee4340 17423->18081 17427 7ff698ee7d7a 17426->17427 17428 7ff698ee8de0 57 API calls 17427->17428 17429 7ff698ee7d9c GetEnvironmentVariableW 17428->17429 17430 7ff698ee7db4 ExpandEnvironmentStringsW 17429->17430 17431 7ff698ee7e06 17429->17431 17433 7ff698ee8ef0 59 API calls 17430->17433 17432 7ff698eec010 _wfindfirst32i64 8 API calls 17431->17432 17434 7ff698ee7e18 17432->17434 17435 7ff698ee7ddc 17433->17435 17434->17269 17435->17431 17436 7ff698ee7de6 17435->17436 18096 7ff698efb1bc 17436->18096 17439 7ff698eec010 _wfindfirst32i64 8 API calls 17440 7ff698ee7dfe 17439->17440 17440->17269 17442 7ff698ee8de0 57 API calls 17441->17442 17443 7ff698ee8267 SetEnvironmentVariableW 17442->17443 17444 7ff698ee827f __std_exception_destroy 17443->17444 17444->17273 17446 7ff698ee1cae 17445->17446 17447 7ff698ee1ee0 49 API calls 17446->17447 17448 7ff698ee1ce4 17447->17448 17449 7ff698ee1dce 17448->17449 17450 7ff698ee1ee0 49 API calls 17448->17450 17451 7ff698eec010 _wfindfirst32i64 8 API calls 17449->17451 17452 7ff698ee1d0a 17450->17452 17453 7ff698ee1e5c 17451->17453 17452->17449 18103 7ff698ee1a90 17452->18103 17453->17277 17453->17278 17457 7ff698ee1dbc 17458 7ff698ee3e80 49 API calls 17457->17458 17458->17449 17459 7ff698ee1d7f 17459->17457 17460 7ff698ee1e24 17459->17460 17461 7ff698ee3e80 49 API calls 17460->17461 17462 7ff698ee1e31 17461->17462 18139 7ff698ee4140 17462->18139 17465 7ff698ee8b95 17464->17465 18181 7ff698ee8860 GetCurrentProcess OpenProcessToken 17465->18181 17468 7ff698ee8860 7 API calls 17469 7ff698ee8bc1 17468->17469 17470 7ff698ee8bf4 17469->17470 17471 7ff698ee8bda 17469->17471 17472 7ff698ee8950 48 API calls 17470->17472 18191 7ff698ee8950 17471->18191 17474 7ff698ee8c07 LocalFree LocalFree 17472->17474 17476 7ff698ee8c23 17474->17476 17478 7ff698ee8c2f 17474->17478 18195 7ff698ee2c30 17476->18195 17479 7ff698eec010 _wfindfirst32i64 8 API calls 17478->17479 17480 7ff698ee3b4e 17479->17480 17480->17292 17481 7ff698ee14e0 17480->17481 17482 7ff698ee156f 17481->17482 17483 7ff698ee14f6 17481->17483 17482->17279 18399 7ff698ee7b60 17483->18399 17489 7ff698ee8e01 MultiByteToWideChar 17488->17489 17490 7ff698ee8e87 MultiByteToWideChar 17488->17490 17493 7ff698ee8e27 17489->17493 17498 7ff698ee8e4c 17489->17498 17491 7ff698ee8ecf 17490->17491 17492 7ff698ee8eaa 17490->17492 17491->17288 17494 7ff698ee29c0 55 API calls 17492->17494 17495 7ff698ee29c0 55 API calls 17493->17495 17496 7ff698ee8ebd 17494->17496 17497 7ff698ee8e3a 17495->17497 17496->17288 17497->17288 17498->17490 17499 7ff698ee8e62 17498->17499 17500 7ff698ee29c0 55 API calls 17499->17500 17501 7ff698ee8e75 17500->17501 17501->17288 17503 7ff698ee7005 17502->17503 17504 7ff698ee3be0 17503->17504 17505 7ff698ee2870 59 API calls 17503->17505 17504->17296 17600 7ff698ee6ca0 17504->17600 17505->17504 17507 7ff698ee3554 17506->17507 17511 7ff698ee3513 17506->17511 17508 7ff698eec010 _wfindfirst32i64 8 API calls 17507->17508 17509 7ff698ee35a5 17508->17509 17509->17309 17513 7ff698ee8b50 LocalFree 17509->17513 17511->17507 18717 7ff698ee1700 17511->18717 18759 7ff698ee2d50 17511->18759 17513->17322 17515 7ff698ee8de0 57 API calls 17514->17515 17516 7ff698ee81ff 17515->17516 17517 7ff698ee8de0 57 API calls 17516->17517 17518 7ff698ee820f 17517->17518 17519 7ff698ef8610 38 API calls 17518->17519 17520 7ff698ee821d __std_exception_destroy 17519->17520 17520->17327 17522 7ff698ee82a0 17521->17522 17565 7ff698ee2b30 17564->17565 17566 7ff698ef52b4 49 API calls 17565->17566 17567 7ff698ee2b7b __scrt_get_show_window_mode 17566->17567 17568 7ff698ee8de0 57 API calls 17567->17568 17569 7ff698ee2bb0 17568->17569 17570 7ff698ee2bb5 17569->17570 17571 7ff698ee2bed MessageBoxA 17569->17571 17572 7ff698ee8de0 57 API calls 17570->17572 17573 7ff698ee2c07 17571->17573 17574 7ff698ee2bcf MessageBoxW 17572->17574 17575 7ff698eec010 _wfindfirst32i64 8 API calls 17573->17575 17574->17573 17576 7ff698ee2c17 17575->17576 17576->17309 17578 7ff698ee406c 17577->17578 17579 7ff698ee8de0 57 API calls 17578->17579 17580 7ff698ee4097 17579->17580 17581 7ff698ee8de0 57 API calls 17580->17581 17582 7ff698ee40aa 17581->17582 19236 7ff698ef69e4 17582->19236 17585 7ff698eec010 _wfindfirst32i64 8 API calls 17586 7ff698ee3acd 17585->17586 17586->17313 17587 7ff698ee84c0 17586->17587 17588 7ff698ee84e4 17587->17588 17589 7ff698ee85bb __std_exception_destroy 17588->17589 17590 7ff698ef1004 73 API calls 17588->17590 17589->17302 17591 7ff698ee84fe 17590->17591 17591->17589 19615 7ff698ef9894 17591->19615 17597 7ff698ef09ac 17596->17597 19630 7ff698ef0758 17597->19630 17601 7ff698ee6cc3 17600->17601 17602 7ff698ee6cda 17600->17602 17601->17602 19641 7ff698ee1590 17601->19641 17602->17301 17604 7ff698ee6ce4 17604->17602 17605 7ff698ee4140 49 API calls 17604->17605 17606 7ff698ee6d45 17605->17606 17607 7ff698ee2b10 59 API calls 17606->17607 17608 7ff698ee6db5 __std_exception_destroy memcpy_s 17606->17608 17607->17602 17608->17301 17623 7ff698ee681a memcpy_s 17609->17623 17611 7ff698ee693f 17612 7ff698ee4140 49 API calls 17611->17612 17614 7ff698ee69b8 17612->17614 17613 7ff698ee695b 17615 7ff698ee2b10 59 API calls 17613->17615 17618 7ff698ee4140 49 API calls 17614->17618 17621 7ff698ee6951 __std_exception_destroy 17615->17621 17616 7ff698ee4140 49 API calls 17616->17623 17617 7ff698ee6920 17617->17611 17619 7ff698ee4140 49 API calls 17617->17619 17620 7ff698ee69e8 17618->17620 17619->17611 17625 7ff698ee4140 49 API calls 17620->17625 17622 7ff698eec010 _wfindfirst32i64 8 API calls 17621->17622 17624 7ff698ee3c06 17622->17624 17623->17611 17623->17613 17623->17616 17623->17617 17626 7ff698ee1700 135 API calls 17623->17626 17627 7ff698ee6941 17623->17627 19665 7ff698ee1940 17623->19665 17624->17314 17629 7ff698ee6780 17624->17629 17625->17621 17626->17623 17628 7ff698ee2b10 59 API calls 17627->17628 17628->17621 19669 7ff698ee8470 17629->19669 17631 7ff698ee679c 17632 7ff698ee8470 58 API calls 17631->17632 17633 7ff698ee67af 17632->17633 17634 7ff698ee67e5 17633->17634 17636 7ff698ee67c7 17633->17636 17635 7ff698ee2b10 59 API calls 17634->17635 17637 7ff698ee3c14 17635->17637 19673 7ff698ee7100 GetProcAddress 17636->19673 17637->17314 17637->17324 17646 7ff698ee1f05 17645->17646 17647 7ff698ef52b4 49 API calls 17646->17647 17648 7ff698ee1f28 17647->17648 17648->17323 19732 7ff698ee5dd0 17649->19732 17652 7ff698ee348d 17652->17330 17702 7ff698eebfb0 17683->17702 17686 7ff698ee2a09 17704 7ff698ef52b4 17686->17704 17691 7ff698ee1ee0 49 API calls 17692 7ff698ee2a66 __scrt_get_show_window_mode 17691->17692 17693 7ff698ee8de0 54 API calls 17692->17693 17694 7ff698ee2a9b 17693->17694 17695 7ff698ee2aa0 17694->17695 17696 7ff698ee2ad8 MessageBoxA 17694->17696 17697 7ff698ee8de0 54 API calls 17695->17697 17698 7ff698ee2af2 17696->17698 17699 7ff698ee2aba MessageBoxW 17697->17699 17700 7ff698eec010 _wfindfirst32i64 8 API calls 17698->17700 17699->17698 17701 7ff698ee2b02 17700->17701 17701->17393 17703 7ff698ee29dc GetLastError 17702->17703 17703->17686 17707 7ff698ef530e 17704->17707 17705 7ff698ef5333 17706 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17705->17706 17712 7ff698ef535d 17706->17712 17707->17705 17708 7ff698ef536f 17707->17708 17734 7ff698ef3540 17708->17734 17710 7ff698ef544c 17711 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17710->17711 17711->17712 17713 7ff698eec010 _wfindfirst32i64 8 API calls 17712->17713 17715 7ff698ee2a37 17713->17715 17722 7ff698ee8770 17715->17722 17716 7ff698ef5470 17716->17710 17719 7ff698ef547a 17716->17719 17717 7ff698ef5421 17720 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17717->17720 17718 7ff698ef5418 17718->17710 17718->17717 17721 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17719->17721 17720->17712 17721->17712 17723 7ff698ee877c 17722->17723 17724 7ff698ee879d FormatMessageW 17723->17724 17725 7ff698ee8797 GetLastError 17723->17725 17726 7ff698ee87d0 17724->17726 17727 7ff698ee87ec WideCharToMultiByte 17724->17727 17725->17724 17728 7ff698ee29c0 54 API calls 17726->17728 17729 7ff698ee87e3 17727->17729 17730 7ff698ee8826 17727->17730 17728->17729 17732 7ff698eec010 _wfindfirst32i64 8 API calls 17729->17732 17731 7ff698ee29c0 54 API calls 17730->17731 17731->17729 17733 7ff698ee2a3e 17732->17733 17733->17691 17735 7ff698ef357e 17734->17735 17736 7ff698ef356e 17734->17736 17737 7ff698ef35b5 17735->17737 17738 7ff698ef3587 17735->17738 17741 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17736->17741 17737->17736 17740 7ff698ef35ad 17737->17740 17744 7ff698ef3864 17737->17744 17748 7ff698ef3ed0 17737->17748 17774 7ff698ef3b98 17737->17774 17804 7ff698ef3420 17737->17804 17807 7ff698ef50f0 17737->17807 17739 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17738->17739 17739->17740 17740->17710 17740->17716 17740->17717 17740->17718 17741->17740 17746 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17744->17746 17746->17736 17749 7ff698ef3f85 17748->17749 17750 7ff698ef3f12 17748->17750 17753 7ff698ef3fdf 17749->17753 17754 7ff698ef3f8a 17749->17754 17751 7ff698ef3faf 17750->17751 17752 7ff698ef3f18 17750->17752 17831 7ff698ef2480 17751->17831 17759 7ff698ef3f1d 17752->17759 17762 7ff698ef3fee 17752->17762 17753->17751 17753->17762 17772 7ff698ef3f48 17753->17772 17755 7ff698ef3fbf 17754->17755 17756 7ff698ef3f8c 17754->17756 17838 7ff698ef2070 17755->17838 17761 7ff698ef3f9b 17756->17761 17766 7ff698ef3f2d 17756->17766 17763 7ff698ef3f60 17759->17763 17759->17766 17759->17772 17761->17751 17767 7ff698ef3fa0 17761->17767 17773 7ff698ef401d 17762->17773 17845 7ff698ef2890 17762->17845 17763->17773 17823 7ff698ef4cf0 17763->17823 17766->17773 17813 7ff698ef4834 17766->17813 17767->17773 17827 7ff698ef4e88 17767->17827 17768 7ff698eec010 _wfindfirst32i64 8 API calls 17770 7ff698ef42b3 17768->17770 17770->17737 17772->17773 17852 7ff698eff608 17772->17852 17773->17768 17775 7ff698ef3ba3 17774->17775 17776 7ff698ef3bb9 17774->17776 17777 7ff698ef3f85 17775->17777 17778 7ff698ef3f12 17775->17778 17780 7ff698ef3bf7 17775->17780 17779 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17776->17779 17776->17780 17783 7ff698ef3fdf 17777->17783 17784 7ff698ef3f8a 17777->17784 17781 7ff698ef3faf 17778->17781 17782 7ff698ef3f18 17778->17782 17779->17780 17780->17737 17787 7ff698ef2480 38 API calls 17781->17787 17790 7ff698ef3f1d 17782->17790 17793 7ff698ef3fee 17782->17793 17783->17781 17783->17793 17802 7ff698ef3f48 17783->17802 17785 7ff698ef3fbf 17784->17785 17786 7ff698ef3f8c 17784->17786 17788 7ff698ef2070 38 API calls 17785->17788 17791 7ff698ef3f9b 17786->17791 17795 7ff698ef3f2d 17786->17795 17787->17802 17788->17802 17789 7ff698ef4834 47 API calls 17789->17802 17792 7ff698ef3f60 17790->17792 17790->17795 17790->17802 17791->17781 17797 7ff698ef3fa0 17791->17797 17796 7ff698ef4cf0 47 API calls 17792->17796 17803 7ff698ef401d 17792->17803 17794 7ff698ef2890 38 API calls 17793->17794 17793->17803 17794->17802 17795->17789 17795->17803 17796->17802 17799 7ff698ef4e88 37 API calls 17797->17799 17797->17803 17798 7ff698eec010 _wfindfirst32i64 8 API calls 17800 7ff698ef42b3 17798->17800 17799->17802 17800->17737 17801 7ff698eff608 47 API calls 17801->17802 17802->17801 17802->17803 17803->17798 17989 7ff698ef1644 17804->17989 17808 7ff698ef5107 17807->17808 18006 7ff698efe768 17808->18006 17814 7ff698ef4856 17813->17814 17862 7ff698ef14b0 17814->17862 17818 7ff698ef4993 17819 7ff698ef4a1c 17818->17819 17822 7ff698ef50f0 45 API calls 17818->17822 17819->17772 17821 7ff698ef50f0 45 API calls 17821->17818 17822->17819 17824 7ff698ef4d70 17823->17824 17825 7ff698ef4d08 17823->17825 17824->17772 17825->17824 17826 7ff698eff608 47 API calls 17825->17826 17826->17824 17830 7ff698ef4ea9 17827->17830 17828 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17829 7ff698ef4eda 17828->17829 17829->17772 17830->17828 17830->17829 17832 7ff698ef24b3 17831->17832 17833 7ff698ef24e2 17832->17833 17835 7ff698ef259f 17832->17835 17834 7ff698ef14b0 12 API calls 17833->17834 17837 7ff698ef251f 17833->17837 17834->17837 17836 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17835->17836 17836->17837 17837->17772 17839 7ff698ef20a3 17838->17839 17840 7ff698ef20d2 17839->17840 17842 7ff698ef218f 17839->17842 17841 7ff698ef14b0 12 API calls 17840->17841 17844 7ff698ef210f 17840->17844 17841->17844 17843 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17842->17843 17843->17844 17844->17772 17846 7ff698ef28c3 17845->17846 17847 7ff698ef28f2 17846->17847 17849 7ff698ef29af 17846->17849 17848 7ff698ef14b0 12 API calls 17847->17848 17851 7ff698ef292f 17847->17851 17848->17851 17850 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17849->17850 17850->17851 17851->17772 17853 7ff698eff630 17852->17853 17854 7ff698eff675 17853->17854 17855 7ff698ef50f0 45 API calls 17853->17855 17857 7ff698eff65e __scrt_get_show_window_mode 17853->17857 17861 7ff698eff635 __scrt_get_show_window_mode 17853->17861 17854->17857 17858 7ff698f01640 WideCharToMultiByte 17854->17858 17854->17861 17855->17854 17856 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17856->17861 17857->17856 17857->17861 17859 7ff698eff751 17858->17859 17860 7ff698eff766 GetLastError 17859->17860 17859->17861 17860->17857 17860->17861 17861->17772 17863 7ff698ef14e7 17862->17863 17869 7ff698ef14d6 17862->17869 17864 7ff698efe3ac _fread_nolock 12 API calls 17863->17864 17863->17869 17865 7ff698ef1514 17864->17865 17866 7ff698ef1528 17865->17866 17867 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17865->17867 17868 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17866->17868 17867->17866 17868->17869 17870 7ff698eff320 17869->17870 17871 7ff698eff370 17870->17871 17872 7ff698eff33d 17870->17872 17871->17872 17875 7ff698eff3a2 17871->17875 17873 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17872->17873 17874 7ff698ef4971 17873->17874 17874->17818 17874->17821 17880 7ff698eff4b5 17875->17880 17885 7ff698eff3ea 17875->17885 17876 7ff698eff5a7 17916 7ff698efe80c 17876->17916 17877 7ff698eff56d 17909 7ff698efeba4 17877->17909 17879 7ff698eff53c 17902 7ff698efee84 17879->17902 17880->17876 17880->17877 17880->17879 17882 7ff698eff4ff 17880->17882 17884 7ff698eff4f5 17880->17884 17892 7ff698eff0b4 17882->17892 17884->17877 17887 7ff698eff4fa 17884->17887 17885->17874 17888 7ff698efb25c __std_exception_copy 37 API calls 17885->17888 17887->17879 17887->17882 17889 7ff698eff4a2 17888->17889 17889->17874 17890 7ff698efb6b8 _wfindfirst32i64 17 API calls 17889->17890 17891 7ff698eff604 17890->17891 17925 7ff698f04efc 17892->17925 17896 7ff698eff15c 17897 7ff698eff1b1 17896->17897 17899 7ff698eff17c 17896->17899 17901 7ff698eff160 17896->17901 17978 7ff698efeca0 17897->17978 17974 7ff698efef5c 17899->17974 17901->17874 17903 7ff698f04efc 38 API calls 17902->17903 17904 7ff698efeece 17903->17904 17905 7ff698f04944 37 API calls 17904->17905 17907 7ff698efef1e 17905->17907 17906 7ff698efef22 17906->17874 17907->17906 17908 7ff698efef5c 45 API calls 17907->17908 17908->17906 17910 7ff698f04efc 38 API calls 17909->17910 17911 7ff698efebef 17910->17911 17912 7ff698f04944 37 API calls 17911->17912 17913 7ff698efec47 17912->17913 17914 7ff698efec4b 17913->17914 17915 7ff698efeca0 45 API calls 17913->17915 17914->17874 17915->17914 17917 7ff698efe884 17916->17917 17918 7ff698efe851 17916->17918 17920 7ff698efe89c 17917->17920 17922 7ff698efe91d 17917->17922 17919 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17918->17919 17924 7ff698efe87d __scrt_get_show_window_mode 17919->17924 17921 7ff698efeba4 46 API calls 17920->17921 17921->17924 17923 7ff698ef50f0 45 API calls 17922->17923 17922->17924 17923->17924 17924->17874 17926 7ff698f04f4f fegetenv 17925->17926 17927 7ff698f08e5c 37 API calls 17926->17927 17930 7ff698f04fa2 17927->17930 17928 7ff698f04fcf 17933 7ff698efb25c __std_exception_copy 37 API calls 17928->17933 17929 7ff698f05092 17931 7ff698f08e5c 37 API calls 17929->17931 17930->17929 17935 7ff698f0506c 17930->17935 17936 7ff698f04fbd 17930->17936 17932 7ff698f050bc 17931->17932 17937 7ff698f08e5c 37 API calls 17932->17937 17934 7ff698f0504d 17933->17934 17938 7ff698f06174 17934->17938 17944 7ff698f05055 17934->17944 17939 7ff698efb25c __std_exception_copy 37 API calls 17935->17939 17936->17928 17936->17929 17940 7ff698f050cd 17937->17940 17941 7ff698efb6b8 _wfindfirst32i64 17 API calls 17938->17941 17939->17934 17942 7ff698f09050 20 API calls 17940->17942 17943 7ff698f06189 17941->17943 17952 7ff698f05136 __scrt_get_show_window_mode 17942->17952 17945 7ff698eec010 _wfindfirst32i64 8 API calls 17944->17945 17946 7ff698eff101 17945->17946 17970 7ff698f04944 17946->17970 17947 7ff698f054df __scrt_get_show_window_mode 17948 7ff698f0581f 17949 7ff698f04a60 37 API calls 17948->17949 17956 7ff698f05f37 17949->17956 17950 7ff698f057cb 17950->17948 17953 7ff698f0618c memcpy_s 37 API calls 17950->17953 17951 7ff698f05177 memcpy_s 17966 7ff698f05abb memcpy_s __scrt_get_show_window_mode 17951->17966 17967 7ff698f055d3 memcpy_s __scrt_get_show_window_mode 17951->17967 17952->17947 17952->17951 17954 7ff698ef5cb4 _findclose 11 API calls 17952->17954 17953->17948 17955 7ff698f055b0 17954->17955 17957 7ff698efb698 _invalid_parameter_noinfo 37 API calls 17955->17957 17958 7ff698f0618c memcpy_s 37 API calls 17956->17958 17962 7ff698f05f92 17956->17962 17957->17951 17958->17962 17959 7ff698f06118 17961 7ff698f08e5c 37 API calls 17959->17961 17960 7ff698ef5cb4 11 API calls _findclose 17960->17967 17961->17944 17962->17959 17964 7ff698f04a60 37 API calls 17962->17964 17969 7ff698f0618c memcpy_s 37 API calls 17962->17969 17963 7ff698ef5cb4 11 API calls _findclose 17963->17966 17964->17962 17965 7ff698efb698 37 API calls _invalid_parameter_noinfo 17965->17966 17966->17948 17966->17950 17966->17963 17966->17965 17967->17950 17967->17960 17968 7ff698efb698 37 API calls _invalid_parameter_noinfo 17967->17968 17968->17967 17969->17962 17971 7ff698f04963 17970->17971 17972 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17971->17972 17973 7ff698f0498e memcpy_s 17971->17973 17972->17973 17973->17896 17975 7ff698efef88 memcpy_s 17974->17975 17976 7ff698ef50f0 45 API calls 17975->17976 17977 7ff698eff042 memcpy_s __scrt_get_show_window_mode 17975->17977 17976->17977 17977->17901 17979 7ff698efecdb 17978->17979 17983 7ff698efed28 memcpy_s 17978->17983 17980 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17979->17980 17981 7ff698efed07 17980->17981 17981->17901 17982 7ff698efed93 17984 7ff698efb25c __std_exception_copy 37 API calls 17982->17984 17983->17982 17985 7ff698ef50f0 45 API calls 17983->17985 17988 7ff698efedd5 memcpy_s 17984->17988 17985->17982 17986 7ff698efb6b8 _wfindfirst32i64 17 API calls 17987 7ff698efee80 17986->17987 17988->17986 17990 7ff698ef1683 17989->17990 17991 7ff698ef1671 17989->17991 17994 7ff698ef1690 17990->17994 17998 7ff698ef16cd 17990->17998 17992 7ff698ef5cb4 _findclose 11 API calls 17991->17992 17993 7ff698ef1676 17992->17993 17995 7ff698efb698 _invalid_parameter_noinfo 37 API calls 17993->17995 17996 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 17994->17996 18003 7ff698ef1681 17995->18003 17996->18003 17997 7ff698ef1776 18000 7ff698ef5cb4 _findclose 11 API calls 17997->18000 17997->18003 17998->17997 17999 7ff698ef5cb4 _findclose 11 API calls 17998->17999 18001 7ff698ef176b 17999->18001 18002 7ff698ef1820 18000->18002 18004 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18001->18004 18005 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18002->18005 18003->17737 18004->17997 18005->18003 18007 7ff698efe781 18006->18007 18008 7ff698ef512f 18006->18008 18007->18008 18009 7ff698f04154 45 API calls 18007->18009 18010 7ff698efe7d4 18008->18010 18009->18008 18011 7ff698ef513f 18010->18011 18012 7ff698efe7ed 18010->18012 18011->17737 18012->18011 18013 7ff698f034a0 45 API calls 18012->18013 18013->18011 18021 7ff698ef5b5c EnterCriticalSection 18014->18021 18023 7ff698ee288c 18022->18023 18024 7ff698ef52b4 49 API calls 18023->18024 18025 7ff698ee28dd 18024->18025 18026 7ff698ef5cb4 _findclose 11 API calls 18025->18026 18027 7ff698ee28e2 18026->18027 18041 7ff698ef5cd4 18027->18041 18030 7ff698ee1ee0 49 API calls 18031 7ff698ee2911 __scrt_get_show_window_mode 18030->18031 18032 7ff698ee8de0 57 API calls 18031->18032 18033 7ff698ee2946 18032->18033 18034 7ff698ee2983 MessageBoxA 18033->18034 18035 7ff698ee294b 18033->18035 18037 7ff698ee299d 18034->18037 18036 7ff698ee8de0 57 API calls 18035->18036 18038 7ff698ee2965 MessageBoxW 18036->18038 18039 7ff698eec010 _wfindfirst32i64 8 API calls 18037->18039 18038->18037 18040 7ff698ee29ad 18039->18040 18040->17404 18042 7ff698efc078 _findclose 11 API calls 18041->18042 18043 7ff698ef5ceb 18042->18043 18044 7ff698ee28e9 18043->18044 18045 7ff698eff948 _findclose 11 API calls 18043->18045 18048 7ff698ef5d2b 18043->18048 18044->18030 18046 7ff698ef5d20 18045->18046 18047 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18046->18047 18047->18048 18048->18044 18053 7ff698f00018 18048->18053 18051 7ff698efb6b8 _wfindfirst32i64 17 API calls 18052 7ff698ef5d70 18051->18052 18057 7ff698f00035 18053->18057 18054 7ff698f0003a 18055 7ff698ef5d51 18054->18055 18056 7ff698ef5cb4 _findclose 11 API calls 18054->18056 18055->18044 18055->18051 18058 7ff698f00044 18056->18058 18057->18054 18057->18055 18060 7ff698f00084 18057->18060 18059 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18058->18059 18059->18055 18060->18055 18061 7ff698ef5cb4 _findclose 11 API calls 18060->18061 18061->18058 18063 7ff698ee8f14 WideCharToMultiByte 18062->18063 18064 7ff698ee8f82 WideCharToMultiByte 18062->18064 18066 7ff698ee8f3e 18063->18066 18070 7ff698ee8f55 18063->18070 18065 7ff698ee8faf 18064->18065 18068 7ff698ee3f6b 18064->18068 18067 7ff698ee29c0 57 API calls 18065->18067 18069 7ff698ee29c0 57 API calls 18066->18069 18067->18068 18068->17414 18068->17415 18069->18068 18070->18064 18071 7ff698ee8f6b 18070->18071 18072 7ff698ee29c0 57 API calls 18071->18072 18072->18068 18074 7ff698ee40ea 18073->18074 18075 7ff698ee8de0 57 API calls 18074->18075 18076 7ff698ee4112 18075->18076 18091 7ff698ee8d00 FindFirstFileExW 18076->18091 18079 7ff698eec010 _wfindfirst32i64 8 API calls 18080 7ff698ee3f88 18079->18080 18080->17413 18080->17421 18082 7ff698ee4352 18081->18082 18083 7ff698ee8de0 57 API calls 18082->18083 18084 7ff698ee4380 CreateFileW 18083->18084 18085 7ff698ee43b7 GetFinalPathNameByHandleW CloseHandle 18084->18085 18090 7ff698ee441f 18084->18090 18087 7ff698ee43e3 __vcrt_FlsAlloc 18085->18087 18085->18090 18086 7ff698eec010 _wfindfirst32i64 8 API calls 18089 7ff698ee3fb9 18086->18089 18088 7ff698ee8ef0 59 API calls 18087->18088 18088->18090 18089->17413 18090->18086 18092 7ff698ee8d50 18091->18092 18093 7ff698ee8d3d FindClose 18091->18093 18094 7ff698eec010 _wfindfirst32i64 8 API calls 18092->18094 18093->18092 18095 7ff698ee411c 18094->18095 18095->18079 18097 7ff698ee7dee 18096->18097 18098 7ff698efb1d3 18096->18098 18097->17439 18098->18097 18099 7ff698efb25c __std_exception_copy 37 API calls 18098->18099 18100 7ff698efb200 18099->18100 18100->18097 18101 7ff698efb6b8 _wfindfirst32i64 17 API calls 18100->18101 18102 7ff698efb230 18101->18102 18104 7ff698ee4060 116 API calls 18103->18104 18105 7ff698ee1ac6 18104->18105 18106 7ff698ee1c74 18105->18106 18108 7ff698ee84c0 83 API calls 18105->18108 18107 7ff698eec010 _wfindfirst32i64 8 API calls 18106->18107 18109 7ff698ee1c88 18107->18109 18110 7ff698ee1afe 18108->18110 18109->17449 18136 7ff698ee3e80 18109->18136 18134 7ff698ee1b2f 18110->18134 18142 7ff698ef1004 18110->18142 18112 7ff698ef097c 74 API calls 18112->18106 18113 7ff698ee1b18 18114 7ff698ee1b34 18113->18114 18115 7ff698ee1b1c 18113->18115 18146 7ff698ef0ccc 18114->18146 18116 7ff698ee2870 59 API calls 18115->18116 18116->18134 18119 7ff698ee1b4f 18121 7ff698ee2870 59 API calls 18119->18121 18120 7ff698ee1b67 18122 7ff698ef1004 73 API calls 18120->18122 18121->18134 18123 7ff698ee1bb4 18122->18123 18124 7ff698ee1bde 18123->18124 18125 7ff698ee1bc6 18123->18125 18127 7ff698ef0ccc _fread_nolock 53 API calls 18124->18127 18126 7ff698ee2870 59 API calls 18125->18126 18126->18134 18128 7ff698ee1bf3 18127->18128 18129 7ff698ee1c0e 18128->18129 18130 7ff698ee1bf9 18128->18130 18149 7ff698ef0a40 18129->18149 18131 7ff698ee2870 59 API calls 18130->18131 18131->18134 18134->18112 18135 7ff698ee2b10 59 API calls 18135->18134 18137 7ff698ee1ee0 49 API calls 18136->18137 18138 7ff698ee3e9d 18137->18138 18138->17459 18140 7ff698ee1ee0 49 API calls 18139->18140 18141 7ff698ee4170 18140->18141 18141->17449 18143 7ff698ef1034 18142->18143 18155 7ff698ef0d94 18143->18155 18145 7ff698ef104d 18145->18113 18167 7ff698ef0cec 18146->18167 18150 7ff698ee1c22 18149->18150 18151 7ff698ef0a49 18149->18151 18150->18134 18150->18135 18152 7ff698ef5cb4 _findclose 11 API calls 18151->18152 18153 7ff698ef0a4e 18152->18153 18156 7ff698ef0dfe 18155->18156 18157 7ff698ef0dbe 18155->18157 18156->18157 18159 7ff698ef0e0a 18156->18159 18158 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18157->18158 18160 7ff698ef0de5 18158->18160 18166 7ff698ef5b5c EnterCriticalSection 18159->18166 18160->18145 18168 7ff698ef0d16 18167->18168 18169 7ff698ee1b49 18167->18169 18168->18169 18170 7ff698ef0d25 __scrt_get_show_window_mode 18168->18170 18171 7ff698ef0d62 18168->18171 18169->18119 18169->18120 18174 7ff698ef5cb4 _findclose 11 API calls 18170->18174 18180 7ff698ef5b5c EnterCriticalSection 18171->18180 18176 7ff698ef0d3a 18174->18176 18177 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18176->18177 18177->18169 18182 7ff698ee8921 __std_exception_destroy 18181->18182 18183 7ff698ee889f GetTokenInformation 18181->18183 18186 7ff698ee8934 CloseHandle 18182->18186 18187 7ff698ee893a 18182->18187 18184 7ff698ee88c0 GetLastError 18183->18184 18185 7ff698ee88cb 18183->18185 18184->18182 18184->18185 18185->18182 18188 7ff698ee88e7 GetTokenInformation 18185->18188 18186->18187 18187->17468 18188->18182 18189 7ff698ee890a 18188->18189 18189->18182 18190 7ff698ee8914 ConvertSidToStringSidW 18189->18190 18190->18182 18192 7ff698ee8975 18191->18192 18208 7ff698ef5508 18192->18208 18196 7ff698ee2c50 18195->18196 18197 7ff698ef52b4 49 API calls 18196->18197 18198 7ff698ee2c9b __scrt_get_show_window_mode 18197->18198 18199 7ff698ee8de0 57 API calls 18198->18199 18200 7ff698ee2cd0 18199->18200 18201 7ff698ee2cd5 18200->18201 18202 7ff698ee2d0d MessageBoxA 18200->18202 18204 7ff698ee8de0 57 API calls 18201->18204 18203 7ff698ee2d27 18202->18203 18205 7ff698eec010 _wfindfirst32i64 8 API calls 18203->18205 18206 7ff698ee2cef MessageBoxW 18204->18206 18207 7ff698ee2d37 18205->18207 18206->18203 18207->17478 18209 7ff698ef5562 18208->18209 18210 7ff698ef5587 18209->18210 18212 7ff698ef55c3 18209->18212 18211 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18210->18211 18215 7ff698ef55b1 18211->18215 18226 7ff698ef38c0 18212->18226 18216 7ff698eec010 _wfindfirst32i64 8 API calls 18215->18216 18218 7ff698ee8998 18216->18218 18217 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18217->18215 18218->17474 18219 7ff698ef56a4 18219->18217 18220 7ff698ef56ca 18220->18219 18222 7ff698ef56d4 18220->18222 18221 7ff698ef5679 18223 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18221->18223 18225 7ff698efb700 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18222->18225 18223->18215 18224 7ff698ef5670 18224->18219 18224->18221 18225->18215 18227 7ff698ef38fe 18226->18227 18228 7ff698ef38ee 18226->18228 18229 7ff698ef3907 18227->18229 18235 7ff698ef3935 18227->18235 18230 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18228->18230 18231 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18229->18231 18232 7ff698ef392d 18230->18232 18231->18232 18232->18219 18232->18220 18232->18221 18232->18224 18235->18228 18235->18232 18237 7ff698ef42d4 18235->18237 18270 7ff698ef3d20 18235->18270 18307 7ff698ef34b0 18235->18307 18238 7ff698ef4316 18237->18238 18239 7ff698ef4387 18237->18239 18242 7ff698ef43b1 18238->18242 18243 7ff698ef431c 18238->18243 18240 7ff698ef43e0 18239->18240 18241 7ff698ef438c 18239->18241 18247 7ff698ef43ea 18240->18247 18248 7ff698ef43f7 18240->18248 18254 7ff698ef43ef 18240->18254 18246 7ff698ef438e 18241->18246 18251 7ff698ef43c1 18241->18251 18326 7ff698ef2684 18242->18326 18244 7ff698ef4350 18243->18244 18245 7ff698ef4321 18243->18245 18250 7ff698ef4327 18244->18250 18244->18254 18245->18248 18245->18250 18256 7ff698ef439d 18246->18256 18259 7ff698ef4330 18246->18259 18247->18242 18247->18254 18340 7ff698ef4fdc 18248->18340 18257 7ff698ef4362 18250->18257 18250->18259 18265 7ff698ef434b 18250->18265 18333 7ff698ef2274 18251->18333 18268 7ff698ef4420 18254->18268 18344 7ff698ef2a94 18254->18344 18256->18242 18260 7ff698ef43a2 18256->18260 18257->18268 18320 7ff698ef4dc4 18257->18320 18259->18268 18310 7ff698ef4a88 18259->18310 18263 7ff698ef4e88 37 API calls 18260->18263 18260->18268 18262 7ff698eec010 _wfindfirst32i64 8 API calls 18264 7ff698ef471a 18262->18264 18263->18265 18264->18235 18266 7ff698ef50f0 45 API calls 18265->18266 18265->18268 18269 7ff698ef460c 18265->18269 18266->18269 18268->18262 18269->18268 18351 7ff698eff7b8 18269->18351 18271 7ff698ef3d44 18270->18271 18272 7ff698ef3d2e 18270->18272 18275 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18271->18275 18280 7ff698ef3d84 18271->18280 18273 7ff698ef4316 18272->18273 18274 7ff698ef4387 18272->18274 18272->18280 18278 7ff698ef43b1 18273->18278 18279 7ff698ef431c 18273->18279 18276 7ff698ef43e0 18274->18276 18277 7ff698ef438c 18274->18277 18275->18280 18283 7ff698ef43ef 18276->18283 18286 7ff698ef43ea 18276->18286 18287 7ff698ef43f7 18276->18287 18281 7ff698ef43c1 18277->18281 18282 7ff698ef438e 18277->18282 18288 7ff698ef2684 38 API calls 18278->18288 18284 7ff698ef4350 18279->18284 18285 7ff698ef4321 18279->18285 18280->18235 18290 7ff698ef2274 38 API calls 18281->18290 18295 7ff698ef439d 18282->18295 18296 7ff698ef4330 18282->18296 18294 7ff698ef2a94 38 API calls 18283->18294 18306 7ff698ef4420 18283->18306 18284->18283 18289 7ff698ef4327 18284->18289 18285->18287 18285->18289 18286->18278 18286->18283 18292 7ff698ef4fdc 45 API calls 18287->18292 18302 7ff698ef434b 18288->18302 18293 7ff698ef4362 18289->18293 18289->18296 18289->18302 18290->18302 18291 7ff698ef4a88 47 API calls 18291->18302 18292->18302 18297 7ff698ef4dc4 46 API calls 18293->18297 18293->18306 18294->18302 18295->18278 18298 7ff698ef43a2 18295->18298 18296->18291 18296->18306 18297->18302 18300 7ff698ef4e88 37 API calls 18298->18300 18298->18306 18299 7ff698eec010 _wfindfirst32i64 8 API calls 18301 7ff698ef471a 18299->18301 18300->18302 18301->18235 18303 7ff698ef50f0 45 API calls 18302->18303 18305 7ff698ef460c 18302->18305 18302->18306 18303->18305 18304 7ff698eff7b8 46 API calls 18304->18305 18305->18304 18305->18306 18306->18299 18382 7ff698ef18f8 18307->18382 18311 7ff698ef4aae 18310->18311 18312 7ff698ef14b0 12 API calls 18311->18312 18313 7ff698ef4afe 18312->18313 18314 7ff698eff320 46 API calls 18313->18314 18315 7ff698ef4bd1 18314->18315 18321 7ff698ef4df9 18320->18321 18322 7ff698ef4e17 18321->18322 18323 7ff698ef50f0 45 API calls 18321->18323 18325 7ff698ef4e3e 18321->18325 18324 7ff698eff7b8 46 API calls 18322->18324 18323->18322 18324->18325 18325->18265 18327 7ff698ef26b7 18326->18327 18328 7ff698ef26e6 18327->18328 18330 7ff698ef27a3 18327->18330 18332 7ff698ef2723 18328->18332 18363 7ff698ef1558 18328->18363 18331 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18330->18331 18331->18332 18332->18265 18334 7ff698ef22a7 18333->18334 18335 7ff698ef22d6 18334->18335 18337 7ff698ef2393 18334->18337 18336 7ff698ef1558 12 API calls 18335->18336 18339 7ff698ef2313 18335->18339 18336->18339 18338 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18337->18338 18338->18339 18339->18265 18341 7ff698ef501f 18340->18341 18343 7ff698ef5023 __crtLCMapStringW 18341->18343 18371 7ff698ef5078 18341->18371 18343->18265 18345 7ff698ef2ac7 18344->18345 18346 7ff698ef2af6 18345->18346 18348 7ff698ef2bb3 18345->18348 18347 7ff698ef1558 12 API calls 18346->18347 18350 7ff698ef2b33 18346->18350 18347->18350 18349 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18348->18349 18349->18350 18350->18265 18352 7ff698eff7e9 18351->18352 18361 7ff698eff7f7 18351->18361 18353 7ff698eff817 18352->18353 18354 7ff698ef50f0 45 API calls 18352->18354 18352->18361 18354->18353 18361->18269 18364 7ff698ef158f 18363->18364 18365 7ff698ef157e 18363->18365 18364->18365 18366 7ff698efe3ac _fread_nolock 12 API calls 18364->18366 18365->18332 18367 7ff698ef15c0 18366->18367 18372 7ff698ef509e 18371->18372 18373 7ff698ef5096 18371->18373 18372->18343 18374 7ff698ef50f0 45 API calls 18373->18374 18374->18372 18383 7ff698ef193f 18382->18383 18384 7ff698ef192d 18382->18384 18387 7ff698ef194d 18383->18387 18391 7ff698ef1989 18383->18391 18385 7ff698ef5cb4 _findclose 11 API calls 18384->18385 18386 7ff698ef1932 18385->18386 18388 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18386->18388 18389 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 18387->18389 18396 7ff698ef193d 18388->18396 18389->18396 18390 7ff698ef1d05 18392 7ff698ef5cb4 _findclose 11 API calls 18390->18392 18390->18396 18391->18390 18393 7ff698ef5cb4 _findclose 11 API calls 18391->18393 18394 7ff698ef1f99 18392->18394 18395 7ff698ef1cfa 18393->18395 18397 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18394->18397 18398 7ff698efb698 _invalid_parameter_noinfo 37 API calls 18395->18398 18396->18235 18397->18396 18398->18390 18400 7ff698ee7b76 18399->18400 18401 7ff698ee7b9a 18400->18401 18402 7ff698ee7bed GetTempPathW 18400->18402 18404 7ff698ee7d70 61 API calls 18401->18404 18403 7ff698ee7c02 18402->18403 18438 7ff698ee2810 18403->18438 18405 7ff698ee7ba6 18404->18405 18450 7ff698ee7630 18405->18450 18411 7ff698eec010 _wfindfirst32i64 8 API calls 18415 7ff698ee7c1b __std_exception_destroy 18416 7ff698ee7cc6 18415->18416 18421 7ff698ee7c51 18415->18421 18442 7ff698ef92c8 18415->18442 18445 7ff698ee8d80 18415->18445 18418 7ff698ee8ef0 59 API calls 18416->18418 18423 7ff698ee8de0 57 API calls 18421->18423 18432 7ff698ee7c8a __std_exception_destroy 18421->18432 18432->18411 18439 7ff698ee2835 18438->18439 18440 7ff698ef5508 48 API calls 18439->18440 18441 7ff698ee2854 18440->18441 18441->18415 18484 7ff698ef8ef4 18442->18484 18446 7ff698ee8d90 18445->18446 18447 7ff698ee8da6 CreateDirectoryW 18445->18447 18448 7ff698ee2c30 59 API calls 18446->18448 18447->18415 18451 7ff698ee763c 18450->18451 18452 7ff698ee8de0 57 API calls 18451->18452 18453 7ff698ee765e 18452->18453 18454 7ff698ee7666 18453->18454 18455 7ff698ee7679 ExpandEnvironmentStringsW 18453->18455 18456 7ff698ee2b10 59 API calls 18454->18456 18457 7ff698ee769f __std_exception_destroy 18455->18457 18458 7ff698ee7672 18456->18458 18459 7ff698ee76a3 18457->18459 18462 7ff698ee76b6 18457->18462 18718 7ff698ee172e 18717->18718 18719 7ff698ee1716 18717->18719 18720 7ff698ee1734 18718->18720 18721 7ff698ee1758 18718->18721 18722 7ff698ee2b10 59 API calls 18719->18722 18847 7ff698ee12a0 18720->18847 18810 7ff698ee7e20 18721->18810 18725 7ff698ee1722 18722->18725 18725->17511 18728 7ff698ee174f 18728->17511 18729 7ff698ee177d 18732 7ff698ee2870 59 API calls 18729->18732 18730 7ff698ee17a9 18733 7ff698ee4060 116 API calls 18730->18733 18731 7ff698ee2b10 59 API calls 18731->18728 18734 7ff698ee1793 18732->18734 18735 7ff698ee17be 18733->18735 18734->17511 18736 7ff698ee17de 18735->18736 18737 7ff698ee17c6 18735->18737 18739 7ff698ef1004 73 API calls 18736->18739 18738 7ff698ee2b10 59 API calls 18737->18738 18740 7ff698ee17d5 18738->18740 18741 7ff698ee17ef 18739->18741 18745 7ff698ef097c 74 API calls 18740->18745 18742 7ff698ee1813 18741->18742 18743 7ff698ee17f3 18741->18743 18760 7ff698ee2d66 18759->18760 18761 7ff698ee1ee0 49 API calls 18760->18761 18763 7ff698ee2d99 18761->18763 18762 7ff698ee30ca 18763->18762 18764 7ff698ee3e80 49 API calls 18763->18764 18765 7ff698ee2e07 18764->18765 18766 7ff698ee3e80 49 API calls 18765->18766 18767 7ff698ee2e18 18766->18767 18768 7ff698ee2e75 18767->18768 18769 7ff698ee2e39 18767->18769 18771 7ff698ee3190 75 API calls 18768->18771 18969 7ff698ee3190 18769->18969 18772 7ff698ee2e73 18771->18772 18773 7ff698ee2eb4 18772->18773 18774 7ff698ee2ef6 18772->18774 18977 7ff698ee77b0 18773->18977 18775 7ff698ee3190 75 API calls 18774->18775 18777 7ff698ee2f20 18775->18777 18782 7ff698ee3190 75 API calls 18777->18782 18786 7ff698ee2fbc 18777->18786 18784 7ff698ee2f52 18782->18784 18784->18786 18789 7ff698ee3190 75 API calls 18784->18789 18785 7ff698ee1ea0 59 API calls 18787 7ff698ee300f 18785->18787 18786->18785 18802 7ff698ee30cf 18786->18802 18787->18762 18792 7ff698ee1ee0 49 API calls 18787->18792 18791 7ff698ee2f80 18789->18791 18791->18786 18803 7ff698ee3128 18802->18803 19014 7ff698ef5860 18802->19014 18811 7ff698ee7e30 18810->18811 18812 7ff698ee1ee0 49 API calls 18811->18812 18813 7ff698ee7e71 18812->18813 18828 7ff698ee7ef1 18813->18828 18890 7ff698ee3ff0 18813->18890 18815 7ff698eec010 _wfindfirst32i64 8 API calls 18816 7ff698ee1775 18815->18816 18816->18729 18816->18730 18817 7ff698ee7f2b 18896 7ff698ee79d0 18817->18896 18820 7ff698ee7ee0 18824 7ff698ee2c30 59 API calls 18820->18824 18821 7ff698ee7f14 18825 7ff698ee2c30 59 API calls 18821->18825 18822 7ff698ee7d70 61 API calls 18826 7ff698ee7ea2 __std_exception_destroy 18822->18826 18824->18828 18825->18817 18826->18820 18826->18821 18828->18815 18848 7ff698ee12b2 18847->18848 18849 7ff698ee4060 116 API calls 18848->18849 18850 7ff698ee12e2 18849->18850 18851 7ff698ee1301 18850->18851 18852 7ff698ee12ea 18850->18852 18854 7ff698ef1004 73 API calls 18851->18854 18853 7ff698ee2b10 59 API calls 18852->18853 18859 7ff698ee12fa __std_exception_destroy 18853->18859 18855 7ff698ee1313 18854->18855 18856 7ff698ee133d 18855->18856 18857 7ff698ee1317 18855->18857 18863 7ff698ee1380 18856->18863 18864 7ff698ee1358 18856->18864 18858 7ff698ee2870 59 API calls 18857->18858 18860 7ff698ee132e 18858->18860 18861 7ff698eec010 _wfindfirst32i64 8 API calls 18859->18861 18862 7ff698ef097c 74 API calls 18860->18862 18865 7ff698ee1444 18861->18865 18862->18859 18867 7ff698ee139a 18863->18867 18876 7ff698ee1453 18863->18876 18866 7ff698ee2870 59 API calls 18864->18866 18865->18728 18865->18731 18869 7ff698ee1373 18866->18869 18868 7ff698ee1050 98 API calls 18867->18868 18870 7ff698ee13ab 18868->18870 18872 7ff698ef097c 74 API calls 18869->18872 18877 7ff698ee14c2 __std_exception_destroy 18870->18877 18881 7ff698ee13b3 18870->18881 18871 7ff698ef097c 74 API calls 18873 7ff698ee13bf 18871->18873 18872->18859 18875 7ff698ee79d0 64 API calls 18873->18875 18874 7ff698ef0ccc _fread_nolock 53 API calls 18874->18876 18876->18874 18878 7ff698ee14ab 18876->18878 18876->18881 18879 7ff698ef097c 74 API calls 18877->18879 18882 7ff698ee2870 59 API calls 18878->18882 18879->18859 18881->18871 18882->18877 18891 7ff698ee3ffa 18890->18891 18892 7ff698ee8de0 57 API calls 18891->18892 18893 7ff698ee4022 18892->18893 18894 7ff698eec010 _wfindfirst32i64 8 API calls 18893->18894 18895 7ff698ee404a 18894->18895 18895->18817 18895->18822 18895->18826 18897 7ff698ee79e0 18896->18897 18898 7ff698ee1ee0 49 API calls 18897->18898 18899 7ff698ee7a11 18898->18899 18970 7ff698ee31c4 18969->18970 18971 7ff698ef52b4 49 API calls 18970->18971 18972 7ff698ee31ea 18971->18972 18973 7ff698ee31fb 18972->18973 19029 7ff698ef65dc 18972->19029 18975 7ff698eec010 _wfindfirst32i64 8 API calls 18973->18975 18976 7ff698ee3219 18975->18976 18976->18772 18978 7ff698ee77be 18977->18978 18979 7ff698ee4060 116 API calls 18978->18979 18980 7ff698ee77ed 18979->18980 18981 7ff698ee1ee0 49 API calls 18980->18981 19015 7ff698ef586d 19014->19015 19016 7ff698ef589a 19014->19016 19030 7ff698ef6605 19029->19030 19031 7ff698ef65f9 19029->19031 19033 7ff698ef5788 45 API calls 19030->19033 19046 7ff698ef5ef0 19031->19046 19035 7ff698ef662d 19033->19035 19036 7ff698effbd4 5 API calls 19035->19036 19038 7ff698ef663d 19035->19038 19036->19038 19047 7ff698ef5f0a 19046->19047 19048 7ff698ef5f27 19046->19048 19048->19047 19237 7ff698ef6918 19236->19237 19238 7ff698ef693e 19237->19238 19241 7ff698ef6971 19237->19241 19239 7ff698ef5cb4 _findclose 11 API calls 19238->19239 19240 7ff698ef6943 19239->19240 19242 7ff698efb698 _invalid_parameter_noinfo 37 API calls 19240->19242 19243 7ff698ef6984 19241->19243 19244 7ff698ef6977 19241->19244 19248 7ff698ee40b9 19242->19248 19255 7ff698efb9e0 19243->19255 19246 7ff698ef5cb4 _findclose 11 API calls 19244->19246 19246->19248 19248->17585 19268 7ff698f011a8 EnterCriticalSection 19255->19268 19616 7ff698ef98c4 19615->19616 19619 7ff698ef93a0 19616->19619 19620 7ff698ef93bb 19619->19620 19621 7ff698ef93ea 19619->19621 19622 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 19620->19622 19629 7ff698ef5b5c EnterCriticalSection 19621->19629 19625 7ff698ef93db 19622->19625 19631 7ff698ef0773 19630->19631 19632 7ff698ef07a1 19630->19632 19633 7ff698efb5cc _invalid_parameter_noinfo 37 API calls 19631->19633 19634 7ff698ef0793 19632->19634 19640 7ff698ef5b5c EnterCriticalSection 19632->19640 19633->19634 19642 7ff698ee4060 116 API calls 19641->19642 19643 7ff698ee15b7 19642->19643 19644 7ff698ee15bf 19643->19644 19645 7ff698ee15e0 19643->19645 19647 7ff698ee2b10 59 API calls 19644->19647 19646 7ff698ef1004 73 API calls 19645->19646 19648 7ff698ee15f1 19646->19648 19649 7ff698ee15cf 19647->19649 19650 7ff698ee15f5 19648->19650 19651 7ff698ee1611 19648->19651 19649->17604 19652 7ff698ee2870 59 API calls 19650->19652 19653 7ff698ee1641 19651->19653 19654 7ff698ee1621 19651->19654 19661 7ff698ee160c __std_exception_destroy 19652->19661 19656 7ff698ee1656 19653->19656 19662 7ff698ee166d 19653->19662 19655 7ff698ee2870 59 API calls 19654->19655 19655->19661 19658 7ff698ee1050 98 API calls 19656->19658 19657 7ff698ef097c 74 API calls 19659 7ff698ee16e7 19657->19659 19658->19661 19659->17604 19660 7ff698ef0ccc _fread_nolock 53 API calls 19660->19662 19661->19657 19662->19660 19662->19661 19663 7ff698ee16ae 19662->19663 19664 7ff698ee2870 59 API calls 19663->19664 19664->19661 19667 7ff698ee19c3 19665->19667 19668 7ff698ee195f 19665->19668 19666 7ff698ef5860 45 API calls 19666->19668 19667->17623 19668->19666 19668->19667 19670 7ff698ee8de0 57 API calls 19669->19670 19671 7ff698ee8487 LoadLibraryExW 19670->19671 19672 7ff698ee84a4 __std_exception_destroy 19671->19672 19672->17631 19674 7ff698ee714c GetProcAddress 19673->19674 19681 7ff698ee7129 19673->19681 19675 7ff698ee7171 GetProcAddress 19674->19675 19674->19681 19675->19681 19676 7ff698ee29c0 57 API calls 19681->19676 19733 7ff698ee5de0 19732->19733 19734 7ff698ee1ee0 49 API calls 19733->19734 19735 7ff698ee5e12 19734->19735 19736 7ff698ee5e3b 19735->19736 19737 7ff698ee5e1b 19735->19737 19739 7ff698ee5e92 19736->19739 19741 7ff698ee4140 49 API calls 19736->19741 19738 7ff698ee2b10 59 API calls 19737->19738 19759 7ff698ee5e31 19738->19759 19740 7ff698ee4140 49 API calls 19739->19740 19742 7ff698ee5eab 19740->19742 19743 7ff698ee5e5c 19741->19743 19745 7ff698ee5ec9 19742->19745 19749 7ff698ee2b10 59 API calls 19742->19749 19746 7ff698ee5e7a 19743->19746 19751 7ff698ee2b10 59 API calls 19743->19751 19744 7ff698eec010 _wfindfirst32i64 8 API calls 19748 7ff698ee344e 19744->19748 19750 7ff698ee8470 58 API calls 19745->19750 19747 7ff698ee3ff0 57 API calls 19746->19747 19752 7ff698ee5e84 19747->19752 19748->17652 19760 7ff698ee5f30 19748->19760 19749->19745 19753 7ff698ee5ed6 19750->19753 19751->19746 19752->19739 19757 7ff698ee8470 58 API calls 19752->19757 19754 7ff698ee5edb 19753->19754 19755 7ff698ee5efd 19753->19755 19758 7ff698ee29c0 57 API calls 19754->19758 19830 7ff698ee53f0 GetProcAddress 19755->19830 19757->19739 19758->19759 19759->19744 19914 7ff698ee4ff0 19760->19914 19762 7ff698ee5f54 19763 7ff698ee5f6d 19762->19763 19764 7ff698ee5f5c 19762->19764 19921 7ff698ee4730 19763->19921 19765 7ff698ee2b10 59 API calls 19764->19765 19831 7ff698ee5412 19830->19831 19832 7ff698ee5430 GetProcAddress 19830->19832 19834 7ff698ee29c0 57 API calls 19831->19834 19832->19831 19833 7ff698ee5455 GetProcAddress 19832->19833 19833->19831 19835 7ff698ee547a GetProcAddress 19833->19835 19837 7ff698ee5425 19834->19837 19835->19831 19837->19759 19917 7ff698ee5015 19914->19917 19915 7ff698ee501d 19915->19762 19916 7ff698ee535a __std_exception_destroy 19916->19762 19917->19915 19919 7ff698ee51af 19917->19919 19956 7ff698ef74f4 19917->19956 19918 7ff698ee4450 47 API calls 19918->19919 19919->19916 19919->19918 19922 7ff698ee4760 19921->19922 19957 7ff698ef7524 19956->19957 19960 7ff698ef69f0 19957->19960 19961 7ff698ef6a33 19960->19961 19962 7ff698ef6a21 19960->19962 20181 7ff698f0bea9 20182 7ff698f0beb8 20181->20182 20183 7ff698f0bec2 20181->20183 20185 7ff698f01208 LeaveCriticalSection 20182->20185

                                Executed Functions

                                Function 00007FF698EE1000 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 293windowCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 63 7ff698ee1000-7ff698ee39b6 call 7ff698ef0750 call 7ff698ef0748 call 7ff698ee89b0 call 7ff698ef0748 call 7ff698eebfb0 call 7ff698ef5ae0 call 7ff698ef66e8 call 7ff698ee1ea0 81 7ff698ee3b5f 63->81 82 7ff698ee39bc-7ff698ee39cc call 7ff698ee3f00 63->82 84 7ff698ee3b64-7ff698ee3b84 call 7ff698eec010 81->84 82->81 87 7ff698ee39d2-7ff698ee39e5 call 7ff698ee3dd0 82->87 87->81 91 7ff698ee39eb-7ff698ee3a12 call 7ff698ee7d70 87->91 94 7ff698ee3a54-7ff698ee3a7c call 7ff698ee8250 call 7ff698ee1ca0 91->94 95 7ff698ee3a14-7ff698ee3a23 call 7ff698ee7d70 91->95 106 7ff698ee3a82-7ff698ee3a98 call 7ff698ee1ca0 94->106 107 7ff698ee3b2d-7ff698ee3b3e 94->107 95->94 101 7ff698ee3a25-7ff698ee3a2b 95->101 103 7ff698ee3a2d-7ff698ee3a35 101->103 104 7ff698ee3a37-7ff698ee3a51 call 7ff698ef576c call 7ff698ee8250 101->104 103->104 104->94 120 7ff698ee3a9a-7ff698ee3ab2 call 7ff698ee2b10 106->120 121 7ff698ee3ab7-7ff698ee3aba 106->121 110 7ff698ee3b92-7ff698ee3b95 107->110 111 7ff698ee3b40-7ff698ee3b47 107->111 115 7ff698ee3bab-7ff698ee3bc3 call 7ff698ee8de0 110->115 116 7ff698ee3b97-7ff698ee3b9d 110->116 111->110 112 7ff698ee3b49-7ff698ee3b51 call 7ff698ee8b80 111->112 130 7ff698ee3b53 112->130 131 7ff698ee3b85-7ff698ee3b88 call 7ff698ee14e0 112->131 132 7ff698ee3bc5-7ff698ee3bcc 115->132 133 7ff698ee3bce-7ff698ee3bd5 SetDllDirectoryW 115->133 122 7ff698ee3b9f-7ff698ee3ba9 116->122 123 7ff698ee3bdb-7ff698ee3be8 call 7ff698ee6ff0 116->123 120->81 121->107 124 7ff698ee3abc-7ff698ee3ad3 call 7ff698ee4060 121->124 122->115 122->123 138 7ff698ee3c33-7ff698ee3c38 call 7ff698ee6f70 123->138 139 7ff698ee3bea-7ff698ee3bf7 call 7ff698ee6ca0 123->139 141 7ff698ee3ad5-7ff698ee3ad8 124->141 142 7ff698ee3ada-7ff698ee3b06 call 7ff698ee84c0 124->142 137 7ff698ee3b5a call 7ff698ee2b10 130->137 146 7ff698ee3b8d-7ff698ee3b90 131->146 132->137 133->123 137->81 149 7ff698ee3c3d-7ff698ee3c40 138->149 139->138 154 7ff698ee3bf9-7ff698ee3c08 call 7ff698ee6800 139->154 147 7ff698ee3b15-7ff698ee3b2b call 7ff698ee2b10 141->147 142->107 157 7ff698ee3b08-7ff698ee3b10 call 7ff698ef097c 142->157 146->81 146->110 147->81 152 7ff698ee3d11-7ff698ee3d20 call 7ff698ee34a0 149->152 153 7ff698ee3c46-7ff698ee3c50 149->153 152->81 166 7ff698ee3d26-7ff698ee3d55 call 7ff698ee8b50 call 7ff698ee81e0 call 7ff698ee7d70 call 7ff698ee3600 152->166 158 7ff698ee3c53-7ff698ee3c5d 153->158 170 7ff698ee3c0a-7ff698ee3c16 call 7ff698ee6780 154->170 171 7ff698ee3c29-7ff698ee3c2e call 7ff698ee6a50 154->171 157->147 163 7ff698ee3c5f-7ff698ee3c64 158->163 164 7ff698ee3c66-7ff698ee3c68 158->164 163->158 163->164 168 7ff698ee3cb1-7ff698ee3cb7 164->168 169 7ff698ee3c6a-7ff698ee3c8d call 7ff698ee1ee0 164->169 199 7ff698ee3d7a-7ff698ee3daa call 7ff698ee8290 call 7ff698ee6a50 call 7ff698ee6f70 166->199 200 7ff698ee3d57-7ff698ee3d74 PostMessageW GetMessageW 166->200 173 7ff698ee3cdc-7ff698ee3d0c call 7ff698ee3600 call 7ff698ee3440 call 7ff698ee35f0 call 7ff698ee6a50 call 7ff698ee6f70 168->173 174 7ff698ee3cb9-7ff698ee3cd6 PostMessageW GetMessageW 168->174 169->81 182 7ff698ee3c93-7ff698ee3c9d 169->182 170->171 183 7ff698ee3c18-7ff698ee3c27 call 7ff698ee6e40 170->183 171->138 173->84 174->173 186 7ff698ee3ca0-7ff698ee3caf 182->186 183->149 186->168 186->186 210 7ff698ee3dac-7ff698ee3db3 call 7ff698ee7f50 199->210 211 7ff698ee3db8-7ff698ee3dbb call 7ff698ee1e70 199->211 200->199 210->211 214 7ff698ee3dc0-7ff698ee3dc2 211->214 214->84
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message$EnvironmentPost$DirectoryExpandFileModuleNameStringsVariable
                                • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                • API String ID: 2647325126-1544818733
                                • Opcode ID: 7e818fdf10d144ebf1a2c27805d4b093fd68b8386923d87f4e33e82801278a2a
                                • Instruction ID: 898c3329715b69f9a5a5ea30610a6874fac5ecdc68dfb4bc7f281172baa81bcf
                                • Opcode Fuzzy Hash: 7e818fdf10d144ebf1a2c27805d4b093fd68b8386923d87f4e33e82801278a2a
                                • Instruction Fuzzy Hash: 58C18121B0CA4695EA35EB31A4712BE6291FF94784FC041B5EA4EC7697DF3CE905C708
                                Function 00007FF698F06B50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 263 7ff698f06b50-7ff698f06b8b call 7ff698f064d8 call 7ff698f064e0 call 7ff698f06548 270 7ff698f06db5-7ff698f06e01 call 7ff698efb6b8 call 7ff698f064d8 call 7ff698f064e0 call 7ff698f06548 263->270 271 7ff698f06b91-7ff698f06b9c call 7ff698f064e8 263->271 296 7ff698f06f3f-7ff698f06fad call 7ff698efb6b8 call 7ff698f023d0 270->296 297 7ff698f06e07-7ff698f06e12 call 7ff698f064e8 270->297 271->270 276 7ff698f06ba2-7ff698f06bac 271->276 278 7ff698f06bce-7ff698f06bd2 276->278 279 7ff698f06bae-7ff698f06bb1 276->279 282 7ff698f06bd5-7ff698f06bdd 278->282 281 7ff698f06bb4-7ff698f06bbf 279->281 284 7ff698f06bc1-7ff698f06bc8 281->284 285 7ff698f06bca-7ff698f06bcc 281->285 282->282 286 7ff698f06bdf-7ff698f06bf2 call 7ff698efe3ac 282->286 284->281 284->285 285->278 288 7ff698f06bfb-7ff698f06c09 285->288 293 7ff698f06bf4-7ff698f06bf6 call 7ff698efb700 286->293 294 7ff698f06c0a-7ff698f06c16 call 7ff698efb700 286->294 293->288 304 7ff698f06c1d-7ff698f06c25 294->304 317 7ff698f06faf-7ff698f06fb6 296->317 318 7ff698f06fbb-7ff698f06fbe 296->318 297->296 306 7ff698f06e18-7ff698f06e23 call 7ff698f06518 297->306 304->304 307 7ff698f06c27-7ff698f06c38 call 7ff698f01344 304->307 306->296 315 7ff698f06e29-7ff698f06e4c call 7ff698efb700 GetTimeZoneInformation 306->315 307->270 316 7ff698f06c3e-7ff698f06c94 call 7ff698f0b580 * 4 call 7ff698f06a6c 307->316 331 7ff698f06f14-7ff698f06f3e call 7ff698f064d0 call 7ff698f064c0 call 7ff698f064c8 315->331 332 7ff698f06e52-7ff698f06e73 315->332 375 7ff698f06c96-7ff698f06c9a 316->375 323 7ff698f0704b-7ff698f0704e 317->323 321 7ff698f06ff5-7ff698f07008 call 7ff698efe3ac 318->321 322 7ff698f06fc0 318->322 336 7ff698f07013-7ff698f0702e call 7ff698f023d0 321->336 337 7ff698f0700a 321->337 326 7ff698f06fc3 322->326 325 7ff698f07054-7ff698f0705c call 7ff698f06b50 323->325 323->326 334 7ff698f06fc8-7ff698f06ff4 call 7ff698efb700 call 7ff698eec010 325->334 326->334 335 7ff698f06fc3 call 7ff698f06dcc 326->335 339 7ff698f06e75-7ff698f06e7b 332->339 340 7ff698f06e7e-7ff698f06e85 332->340 335->334 361 7ff698f07035-7ff698f07047 call 7ff698efb700 336->361 362 7ff698f07030-7ff698f07033 336->362 344 7ff698f0700c-7ff698f07011 call 7ff698efb700 337->344 339->340 346 7ff698f06e99 340->346 347 7ff698f06e87-7ff698f06e8f 340->347 344->322 357 7ff698f06e9b-7ff698f06f0f call 7ff698f0b580 * 4 call 7ff698f039ac call 7ff698f07064 * 2 346->357 347->346 354 7ff698f06e91-7ff698f06e97 347->354 354->357 357->331 361->323 362->344 377 7ff698f06ca0-7ff698f06ca4 375->377 378 7ff698f06c9c 375->378 377->375 380 7ff698f06ca6-7ff698f06ccb call 7ff698ef75a8 377->380 378->377 386 7ff698f06cce-7ff698f06cd2 380->386 388 7ff698f06cd4-7ff698f06cdf 386->388 389 7ff698f06ce1-7ff698f06ce5 386->389 388->389 391 7ff698f06ce7-7ff698f06ceb 388->391 389->386 394 7ff698f06ced-7ff698f06d15 call 7ff698ef75a8 391->394 395 7ff698f06d6c-7ff698f06d70 391->395 402 7ff698f06d33-7ff698f06d37 394->402 403 7ff698f06d17 394->403 396 7ff698f06d72-7ff698f06d74 395->396 397 7ff698f06d77-7ff698f06d84 395->397 396->397 399 7ff698f06d9f-7ff698f06dae call 7ff698f064d0 call 7ff698f064c0 397->399 400 7ff698f06d86-7ff698f06d9c call 7ff698f06a6c 397->400 399->270 400->399 402->395 408 7ff698f06d39-7ff698f06d57 call 7ff698ef75a8 402->408 406 7ff698f06d1a-7ff698f06d21 403->406 406->402 410 7ff698f06d23-7ff698f06d31 406->410 415 7ff698f06d63-7ff698f06d6a 408->415 410->402 410->406 415->395 416 7ff698f06d59-7ff698f06d5d 415->416 416->395 417 7ff698f06d5f 416->417 417->415
                                APIs
                                • _get_daylight.LIBCMT ref: 00007FF698F06B95
                                  • Part of subcall function 00007FF698F064E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF698F064FC
                                  • Part of subcall function 00007FF698EFB700: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB716
                                  • Part of subcall function 00007FF698EFB700: GetLastError.KERNEL32(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB720
                                  • Part of subcall function 00007FF698EFB6B8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF698EFB697,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFB6C1
                                  • Part of subcall function 00007FF698EFB6B8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF698EFB697,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFB6E6
                                • _get_daylight.LIBCMT ref: 00007FF698F06B84
                                  • Part of subcall function 00007FF698F06548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF698F0655C
                                • _get_daylight.LIBCMT ref: 00007FF698F06DFA
                                • _get_daylight.LIBCMT ref: 00007FF698F06E0B
                                • _get_daylight.LIBCMT ref: 00007FF698F06E1C
                                • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF698F0705C), ref: 00007FF698F06E43
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                • String ID: W. Europe Standard Time$W. Europe Summer Time
                                • API String ID: 1458651798-690618308
                                • Opcode ID: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
                                • Instruction ID: 7d8243830a05fedea73d249ddf59e1a24a6596b6af1dc6bb1526b984b71c0aa7
                                • Opcode Fuzzy Hash: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
                                • Instruction Fuzzy Hash: 0BD1BE76A08B528AEB30AF31D8501B96761EF84BD4FC4A1B5EA4DC7AC5DF3CE4418748
                                Function 00007FF698F07A9C Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 448 7ff698f07a9c-7ff698f07b0f call 7ff698f077d0 451 7ff698f07b11-7ff698f07b1a call 7ff698ef5c94 448->451 452 7ff698f07b29-7ff698f07b33 call 7ff698ef8c58 448->452 459 7ff698f07b1d-7ff698f07b24 call 7ff698ef5cb4 451->459 457 7ff698f07b35-7ff698f07b4c call 7ff698ef5c94 call 7ff698ef5cb4 452->457 458 7ff698f07b4e-7ff698f07bb7 CreateFileW 452->458 457->459 461 7ff698f07c34-7ff698f07c3f GetFileType 458->461 462 7ff698f07bb9-7ff698f07bbf 458->462 475 7ff698f07e6a-7ff698f07e8a 459->475 468 7ff698f07c92-7ff698f07c99 461->468 469 7ff698f07c41-7ff698f07c7c GetLastError call 7ff698ef5c28 CloseHandle 461->469 465 7ff698f07c01-7ff698f07c2f GetLastError call 7ff698ef5c28 462->465 466 7ff698f07bc1-7ff698f07bc5 462->466 465->459 466->465 473 7ff698f07bc7-7ff698f07bff CreateFileW 466->473 471 7ff698f07ca1-7ff698f07ca4 468->471 472 7ff698f07c9b-7ff698f07c9f 468->472 469->459 482 7ff698f07c82-7ff698f07c8d call 7ff698ef5cb4 469->482 478 7ff698f07caa-7ff698f07cff call 7ff698ef8b70 471->478 479 7ff698f07ca6 471->479 472->478 473->461 473->465 487 7ff698f07d01-7ff698f07d0d call 7ff698f079d8 478->487 488 7ff698f07d1e-7ff698f07d4f call 7ff698f07550 478->488 479->478 482->459 487->488 495 7ff698f07d0f 487->495 493 7ff698f07d55-7ff698f07d97 488->493 494 7ff698f07d51-7ff698f07d53 488->494 497 7ff698f07db9-7ff698f07dc4 493->497 498 7ff698f07d99-7ff698f07d9d 493->498 496 7ff698f07d11-7ff698f07d19 call 7ff698efb878 494->496 495->496 496->475 500 7ff698f07dca-7ff698f07dce 497->500 501 7ff698f07e68 497->501 498->497 499 7ff698f07d9f-7ff698f07db4 498->499 499->497 500->501 504 7ff698f07dd4-7ff698f07e19 CloseHandle CreateFileW 500->504 501->475 505 7ff698f07e4e-7ff698f07e63 504->505 506 7ff698f07e1b-7ff698f07e49 GetLastError call 7ff698ef5c28 call 7ff698ef8d98 504->506 505->501 506->505
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                • String ID:
                                • API String ID: 1617910340-0
                                • Opcode ID: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
                                • Instruction ID: 46398c913e90ff35207547463af1165b14da97a8359c5609c66541f6e6f5db68
                                • Opcode Fuzzy Hash: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
                                • Instruction Fuzzy Hash: 8FC1CE36B28A4689EB20CF74D4906BC3761EB58BD8B9162A5DA1FDB3D4CF39E451C304
                                Function 00007FF698EE7B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF698EE153F), ref: 00007FF698EE7BF7
                                  • Part of subcall function 00007FF698EE7D70: GetEnvironmentVariableW.KERNEL32(00007FF698EE39FF), ref: 00007FF698EE7DAA
                                  • Part of subcall function 00007FF698EE7D70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF698EE7DC7
                                  • Part of subcall function 00007FF698EF8610: _invalid_parameter_noinfo.LIBCMT ref: 00007FF698EF8629
                                • SetEnvironmentVariableW.KERNEL32 ref: 00007FF698EE7CB1
                                  • Part of subcall function 00007FF698EE2B10: MessageBoxW.USER32 ref: 00007FF698EE2BE5
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                • API String ID: 3752271684-1116378104
                                • Opcode ID: 26c14f5d2d519ab3f82a273994a24441e39aec3c57247172eafc601634a0f726
                                • Instruction ID: 0cb167a2975fd5176a96af056dd84e05f9603e000882ed03276318ed2849d819
                                • Opcode Fuzzy Hash: 26c14f5d2d519ab3f82a273994a24441e39aec3c57247172eafc601634a0f726
                                • Instruction Fuzzy Hash: C6515C21B0965741FA34AB32A9252BA5245DF99BC0FC854B1ED4ECB7D7ED3CE401930C
                                Function 00007FF698F06DCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 779 7ff698f06dcc-7ff698f06e01 call 7ff698f064d8 call 7ff698f064e0 call 7ff698f06548 786 7ff698f06f3f-7ff698f06fad call 7ff698efb6b8 call 7ff698f023d0 779->786 787 7ff698f06e07-7ff698f06e12 call 7ff698f064e8 779->787 799 7ff698f06faf-7ff698f06fb6 786->799 800 7ff698f06fbb-7ff698f06fbe 786->800 787->786 792 7ff698f06e18-7ff698f06e23 call 7ff698f06518 787->792 792->786 798 7ff698f06e29-7ff698f06e4c call 7ff698efb700 GetTimeZoneInformation 792->798 811 7ff698f06f14-7ff698f06f3e call 7ff698f064d0 call 7ff698f064c0 call 7ff698f064c8 798->811 812 7ff698f06e52-7ff698f06e73 798->812 804 7ff698f0704b-7ff698f0704e 799->804 802 7ff698f06ff5-7ff698f07008 call 7ff698efe3ac 800->802 803 7ff698f06fc0 800->803 815 7ff698f07013-7ff698f0702e call 7ff698f023d0 802->815 816 7ff698f0700a 802->816 807 7ff698f06fc3 803->807 806 7ff698f07054-7ff698f0705c call 7ff698f06b50 804->806 804->807 813 7ff698f06fc8-7ff698f06ff4 call 7ff698efb700 call 7ff698eec010 806->813 807->813 814 7ff698f06fc3 call 7ff698f06dcc 807->814 818 7ff698f06e75-7ff698f06e7b 812->818 819 7ff698f06e7e-7ff698f06e85 812->819 814->813 837 7ff698f07035-7ff698f07047 call 7ff698efb700 815->837 838 7ff698f07030-7ff698f07033 815->838 822 7ff698f0700c-7ff698f07011 call 7ff698efb700 816->822 818->819 824 7ff698f06e99 819->824 825 7ff698f06e87-7ff698f06e8f 819->825 822->803 833 7ff698f06e9b-7ff698f06f0f call 7ff698f0b580 * 4 call 7ff698f039ac call 7ff698f07064 * 2 824->833 825->824 831 7ff698f06e91-7ff698f06e97 825->831 831->833 833->811 837->804 838->822
                                APIs
                                • _get_daylight.LIBCMT ref: 00007FF698F06DFA
                                  • Part of subcall function 00007FF698F06548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF698F0655C
                                • _get_daylight.LIBCMT ref: 00007FF698F06E0B
                                  • Part of subcall function 00007FF698F064E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF698F064FC
                                • _get_daylight.LIBCMT ref: 00007FF698F06E1C
                                  • Part of subcall function 00007FF698F06518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF698F0652C
                                  • Part of subcall function 00007FF698EFB700: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB716
                                  • Part of subcall function 00007FF698EFB700: GetLastError.KERNEL32(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB720
                                • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF698F0705C), ref: 00007FF698F06E43
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                • String ID: W. Europe Standard Time$W. Europe Summer Time
                                • API String ID: 2248164782-690618308
                                • Opcode ID: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
                                • Instruction ID: 63771072bbd06c7a03345364d8c8ddb66ae9fd3a3923d687863c37f15a8c71f9
                                • Opcode Fuzzy Hash: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
                                • Instruction Fuzzy Hash: 12516F32A187428AE730DF31E8911B9A760FB487C4FC461B5EA5DC7A96DF3CE4418758
                                Function 00007FF698EE8D00 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Find$CloseFileFirst
                                • String ID:
                                • API String ID: 2295610775-0
                                • Opcode ID: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
                                • Instruction ID: ab4a604d109df968d04f9554d38617508d9c838115a717fbf823ea2ba6fc93f0
                                • Opcode Fuzzy Hash: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
                                • Instruction Fuzzy Hash: 0CF08132A186858AEBB08F70F4987667350EB44764F840676D6AD466E5DF3CD0088B04
                                Function 00007FF698F01720 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CurrentFeaturePresentProcessProcessor
                                • String ID:
                                • API String ID: 1010374628-0
                                • Opcode ID: b07a4aa98c3ea62428db7ff75e9c78d2acc70f0ed8e8990dbcc6d64e325556f5
                                • Instruction ID: 40a45768dec7b2f2742ddd94a6fb71e1e9b8973ad48da7fd8c96bdcce258fd7b
                                • Opcode Fuzzy Hash: b07a4aa98c3ea62428db7ff75e9c78d2acc70f0ed8e8990dbcc6d64e325556f5
                                • Instruction Fuzzy Hash: E0028B31E1E68A44FA74AF31A4102792694EF52BE0FD466B5DD5DC73D2EE3CA482930C
                                Function 00007FF698EE1700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 0 7ff698ee1700-7ff698ee1714 1 7ff698ee172e-7ff698ee1732 0->1 2 7ff698ee1716-7ff698ee172d call 7ff698ee2b10 0->2 3 7ff698ee1734-7ff698ee173d call 7ff698ee12a0 1->3 4 7ff698ee1758-7ff698ee177b call 7ff698ee7e20 1->4 11 7ff698ee174f-7ff698ee1757 3->11 12 7ff698ee173f-7ff698ee174a call 7ff698ee2b10 3->12 13 7ff698ee177d-7ff698ee17a8 call 7ff698ee2870 4->13 14 7ff698ee17a9-7ff698ee17c4 call 7ff698ee4060 4->14 12->11 20 7ff698ee17de-7ff698ee17f1 call 7ff698ef1004 14->20 21 7ff698ee17c6-7ff698ee17d9 call 7ff698ee2b10 14->21 27 7ff698ee1813-7ff698ee1817 20->27 28 7ff698ee17f3-7ff698ee180e call 7ff698ee2870 20->28 26 7ff698ee191f-7ff698ee1922 call 7ff698ef097c 21->26 34 7ff698ee1927-7ff698ee193e 26->34 31 7ff698ee1831-7ff698ee1851 call 7ff698ef5780 27->31 32 7ff698ee1819-7ff698ee1825 call 7ff698ee1050 27->32 37 7ff698ee1917-7ff698ee191a call 7ff698ef097c 28->37 41 7ff698ee1853-7ff698ee186d call 7ff698ee2870 31->41 42 7ff698ee1872-7ff698ee1878 31->42 38 7ff698ee182a-7ff698ee182c 32->38 37->26 38->37 49 7ff698ee190d-7ff698ee1912 41->49 44 7ff698ee1905-7ff698ee1908 call 7ff698ef576c 42->44 45 7ff698ee187e-7ff698ee1887 42->45 44->49 48 7ff698ee1890-7ff698ee18b2 call 7ff698ef0ccc 45->48 52 7ff698ee18e5-7ff698ee18ec 48->52 53 7ff698ee18b4-7ff698ee18cc call 7ff698ef140c 48->53 49->37 55 7ff698ee18f3-7ff698ee18fb call 7ff698ee2870 52->55 59 7ff698ee18d5-7ff698ee18e3 53->59 60 7ff698ee18ce-7ff698ee18d1 53->60 61 7ff698ee1900 55->61 59->55 60->48 62 7ff698ee18d3 60->62 61->44 62->61
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message
                                • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                • API String ID: 2030045667-3833288071
                                • Opcode ID: b1d00c3954f2c13fa2643aa237036c27d4f55f603d17907fb94cf2a77ef172c7
                                • Instruction ID: f02d678291d3fcf555c0e0284f78d90048d1a508c3ad83ac38541a5b8b05bbd3
                                • Opcode Fuzzy Hash: b1d00c3954f2c13fa2643aa237036c27d4f55f603d17907fb94cf2a77ef172c7
                                • Instruction Fuzzy Hash: 35518B61B0864286EB309B35E8602B96391FF45BD5FC440B1EE4DC7696EF7CE684D308
                                Function 00007FF698EE1A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _fread_nolock$Message
                                • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                • API String ID: 677216364-1384898525
                                • Opcode ID: 310852eaf13cf17407021eeddddfe5748f0126c135f8f8dbff28962d08b7d14d
                                • Instruction ID: fa34e26f9be4e56ca191bb83e31e525ffc1da8b126581734f1b1885cd790cda7
                                • Opcode Fuzzy Hash: 310852eaf13cf17407021eeddddfe5748f0126c135f8f8dbff28962d08b7d14d
                                • Instruction Fuzzy Hash: 25516B71A0964286EB38DF38E4A017833A0EF48B85BD581B6DA0DC7796DE3CE840C74C
                                Function 00007FF698EE8290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                • String ID: CreateProcessW$Error creating child process!
                                • API String ID: 2895956056-3524285272
                                • Opcode ID: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
                                • Instruction ID: 7887cc6eccdbe386a1baaa1c8b3a31bfdcc65ac3d189f8be861a3d707c098356
                                • Opcode Fuzzy Hash: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
                                • Instruction Fuzzy Hash: BB414632A0878285DA309B74F4552AAB390FF947A4F900775E6AD87BD5DF7CD054CB04
                                Function 00007FF698EE1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 511 7ff698ee1050-7ff698ee10ab call 7ff698eeb840 514 7ff698ee10d3-7ff698ee10eb call 7ff698ef5780 511->514 515 7ff698ee10ad-7ff698ee10d2 call 7ff698ee2b10 511->515 520 7ff698ee10ed-7ff698ee1104 call 7ff698ee2870 514->520 521 7ff698ee1109-7ff698ee1119 call 7ff698ef5780 514->521 526 7ff698ee1264-7ff698ee1279 call 7ff698eeb520 call 7ff698ef576c * 2 520->526 527 7ff698ee111b-7ff698ee1132 call 7ff698ee2870 521->527 528 7ff698ee1137-7ff698ee1149 521->528 542 7ff698ee127e-7ff698ee1298 526->542 527->526 530 7ff698ee1150-7ff698ee1175 call 7ff698ef0ccc 528->530 537 7ff698ee117b-7ff698ee1185 call 7ff698ef0a40 530->537 538 7ff698ee125c 530->538 537->538 544 7ff698ee118b-7ff698ee1197 537->544 538->526 545 7ff698ee11a0-7ff698ee11c8 call 7ff698ee9c80 544->545 548 7ff698ee1241-7ff698ee1257 call 7ff698ee2b10 545->548 549 7ff698ee11ca-7ff698ee11cd 545->549 548->538 550 7ff698ee11cf-7ff698ee11d9 549->550 551 7ff698ee123c 549->551 553 7ff698ee1203-7ff698ee1206 550->553 554 7ff698ee11db-7ff698ee11e8 call 7ff698ef140c 550->554 551->548 556 7ff698ee1219-7ff698ee121e 553->556 557 7ff698ee1208-7ff698ee1216 call 7ff698f0aee0 553->557 559 7ff698ee11ed-7ff698ee11f0 554->559 556->545 558 7ff698ee1220-7ff698ee1223 556->558 557->556 562 7ff698ee1225-7ff698ee1228 558->562 563 7ff698ee1237-7ff698ee123a 558->563 564 7ff698ee11f2-7ff698ee11fc call 7ff698ef0a40 559->564 565 7ff698ee11fe-7ff698ee1201 559->565 562->548 566 7ff698ee122a-7ff698ee1232 562->566 563->538 564->556 564->565 565->548 566->530
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message
                                • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                • API String ID: 2030045667-2813020118
                                • Opcode ID: 31fe241a8b15a525b43ee0d367c6a1aae85d9a9d8a6ec3eab0b03c1893c49f29
                                • Instruction ID: 15346aca38c77929a28809479f0d886917bc7283a198c39968e28d658c027144
                                • Opcode Fuzzy Hash: 31fe241a8b15a525b43ee0d367c6a1aae85d9a9d8a6ec3eab0b03c1893c49f29
                                • Instruction Fuzzy Hash: 7351CF32A0968285EB309B21E8603BA6291FB84794FC441B5EE4DC77D6EF3CE585D708
                                Function 00007FF698EFF9C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • FreeLibrary.KERNEL32(?,?,?,00007FF698EFFD5A,?,?,-00000018,00007FF698EFBB0B,?,?,?,00007FF698EFBA02,?,?,?,00007FF698EF698E), ref: 00007FF698EFFB3C
                                • GetProcAddress.KERNEL32(?,?,?,00007FF698EFFD5A,?,?,-00000018,00007FF698EFBB0B,?,?,?,00007FF698EFBA02,?,?,?,00007FF698EF698E), ref: 00007FF698EFFB48
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: AddressFreeLibraryProc
                                • String ID: api-ms-$ext-ms-
                                • API String ID: 3013587201-537541572
                                • Opcode ID: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
                                • Instruction ID: 2ac2e717d16d30debc4ea12df36ea65c69329deccf4dc7fcbb6370b0c8916cd0
                                • Opcode Fuzzy Hash: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
                                • Instruction Fuzzy Hash: 4C41EF72B19A0281FA36CB36B8205B52396FF59BE0F8955B5DD0DC7784EE3CE4459308
                                Function 00007FF698EFC80C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 666 7ff698efc80c-7ff698efc832 667 7ff698efc834-7ff698efc848 call 7ff698ef5c94 call 7ff698ef5cb4 666->667 668 7ff698efc84d-7ff698efc851 666->668 682 7ff698efcc3e 667->682 670 7ff698efcc27-7ff698efcc33 call 7ff698ef5c94 call 7ff698ef5cb4 668->670 671 7ff698efc857-7ff698efc85e 668->671 689 7ff698efcc39 call 7ff698efb698 670->689 671->670 673 7ff698efc864-7ff698efc892 671->673 673->670 676 7ff698efc898-7ff698efc89f 673->676 679 7ff698efc8a1-7ff698efc8b3 call 7ff698ef5c94 call 7ff698ef5cb4 676->679 680 7ff698efc8b8-7ff698efc8bb 676->680 679->689 685 7ff698efcc23-7ff698efcc25 680->685 686 7ff698efc8c1-7ff698efc8c7 680->686 687 7ff698efcc41-7ff698efcc58 682->687 685->687 686->685 690 7ff698efc8cd-7ff698efc8d0 686->690 689->682 690->679 691 7ff698efc8d2-7ff698efc8f7 690->691 694 7ff698efc92a-7ff698efc931 691->694 695 7ff698efc8f9-7ff698efc8fb 691->695 699 7ff698efc933-7ff698efc95b call 7ff698efe3ac call 7ff698efb700 * 2 694->699 700 7ff698efc906-7ff698efc91d call 7ff698ef5c94 call 7ff698ef5cb4 call 7ff698efb698 694->700 697 7ff698efc922-7ff698efc928 695->697 698 7ff698efc8fd-7ff698efc904 695->698 702 7ff698efc9a8-7ff698efc9bf 697->702 698->697 698->700 727 7ff698efc95d-7ff698efc973 call 7ff698ef5cb4 call 7ff698ef5c94 699->727 728 7ff698efc978-7ff698efc9a3 call 7ff698efd034 699->728 731 7ff698efcab0 700->731 705 7ff698efc9c1-7ff698efc9c9 702->705 706 7ff698efca3a-7ff698efca44 call 7ff698f0476c 702->706 705->706 710 7ff698efc9cb-7ff698efc9cd 705->710 718 7ff698efcace 706->718 719 7ff698efca4a-7ff698efca5f 706->719 710->706 715 7ff698efc9cf-7ff698efc9e5 710->715 715->706 720 7ff698efc9e7-7ff698efc9f3 715->720 723 7ff698efcad3-7ff698efcaf3 ReadFile 718->723 719->718 725 7ff698efca61-7ff698efca73 GetConsoleMode 719->725 720->706 721 7ff698efc9f5-7ff698efc9f7 720->721 721->706 726 7ff698efc9f9-7ff698efca11 721->726 729 7ff698efcbed-7ff698efcbf6 GetLastError 723->729 730 7ff698efcaf9-7ff698efcb01 723->730 725->718 732 7ff698efca75-7ff698efca7d 725->732 726->706 734 7ff698efca13-7ff698efca1f 726->734 727->731 728->702 739 7ff698efcc13-7ff698efcc16 729->739 740 7ff698efcbf8-7ff698efcc0e call 7ff698ef5cb4 call 7ff698ef5c94 729->740 730->729 736 7ff698efcb07 730->736 733 7ff698efcab3-7ff698efcabd call 7ff698efb700 731->733 732->723 738 7ff698efca7f-7ff698efcaa1 ReadConsoleW 732->738 733->687 734->706 742 7ff698efca21-7ff698efca23 734->742 746 7ff698efcb0e-7ff698efcb23 736->746 748 7ff698efcaa3 GetLastError 738->748 749 7ff698efcac2-7ff698efcacc 738->749 743 7ff698efcc1c-7ff698efcc1e 739->743 744 7ff698efcaa9-7ff698efcaab call 7ff698ef5c28 739->744 740->731 742->706 753 7ff698efca25-7ff698efca35 742->753 743->733 744->731 746->733 755 7ff698efcb25-7ff698efcb30 746->755 748->744 749->746 753->706 759 7ff698efcb32-7ff698efcb4b call 7ff698efc424 755->759 760 7ff698efcb57-7ff698efcb5f 755->760 766 7ff698efcb50-7ff698efcb52 759->766 763 7ff698efcb61-7ff698efcb73 760->763 764 7ff698efcbdb-7ff698efcbe8 call 7ff698efc264 760->764 767 7ff698efcb75 763->767 768 7ff698efcbce-7ff698efcbd6 763->768 764->766 766->733 769 7ff698efcb7a-7ff698efcb81 767->769 768->733 771 7ff698efcb83-7ff698efcb87 769->771 772 7ff698efcbbd-7ff698efcbc8 769->772 773 7ff698efcba3 771->773 774 7ff698efcb89-7ff698efcb90 771->774 772->768 776 7ff698efcba9-7ff698efcbb9 773->776 774->773 775 7ff698efcb92-7ff698efcb96 774->775 775->773 777 7ff698efcb98-7ff698efcba1 775->777 776->769 778 7ff698efcbbb 776->778 777->776 778->768
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: a6b3ac16ea139d0eba2342f9c6540c26576aaa7a7e0ca2cda94d9f3d90bbf969
                                • Instruction ID: dddbb025b7a739793585647e16098b11f4b1b02ba7eab343c639e890ba726557
                                • Opcode Fuzzy Hash: a6b3ac16ea139d0eba2342f9c6540c26576aaa7a7e0ca2cda94d9f3d90bbf969
                                • Instruction Fuzzy Hash: ABC1C532A0CA9791E671DB35A4602BD3B55FBA0BC0FE541B1DA4E87391DE7CE845E308
                                Function 00007FF698EE8860 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                • String ID:
                                • API String ID: 995526605-0
                                • Opcode ID: 0a78fddd52e4a4b47c0abd3b9ff92470e3f80b7b026c685fad37238cb9e723cb
                                • Instruction ID: 6f8e47f76731acc35396c2b3753c6e1fbe5d58b869657ec76a2819df367eb94c
                                • Opcode Fuzzy Hash: 0a78fddd52e4a4b47c0abd3b9ff92470e3f80b7b026c685fad37238cb9e723cb
                                • Instruction Fuzzy Hash: 1B216531A0CA4686EB209F75F45013AA3A0EF857A0F904275DAADC3BE5DF7DE454C704
                                Function 00007FF698EE8B80 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                  • Part of subcall function 00007FF698EE8860: GetCurrentProcess.KERNEL32 ref: 00007FF698EE8880
                                  • Part of subcall function 00007FF698EE8860: OpenProcessToken.ADVAPI32 ref: 00007FF698EE8891
                                  • Part of subcall function 00007FF698EE8860: GetTokenInformation.KERNELBASE ref: 00007FF698EE88B6
                                  • Part of subcall function 00007FF698EE8860: GetLastError.KERNEL32 ref: 00007FF698EE88C0
                                  • Part of subcall function 00007FF698EE8860: GetTokenInformation.KERNELBASE ref: 00007FF698EE8900
                                  • Part of subcall function 00007FF698EE8860: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF698EE891C
                                  • Part of subcall function 00007FF698EE8860: CloseHandle.KERNEL32 ref: 00007FF698EE8934
                                • LocalFree.KERNEL32(00000000,00007FF698EE3B4E), ref: 00007FF698EE8C0C
                                • LocalFree.KERNEL32 ref: 00007FF698EE8C15
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
                                • API String ID: 6828938-1817031585
                                • Opcode ID: b6111afcc3eeb0b408ea35522252114c0c7814765020da058c7306c730e1b11f
                                • Instruction ID: 374e7e43f899cfc7db31c379dcac05a92ff4b993d8840096d7814337bdc13cae
                                • Opcode Fuzzy Hash: b6111afcc3eeb0b408ea35522252114c0c7814765020da058c7306c730e1b11f
                                • Instruction Fuzzy Hash: 23215E32A1868A85F6309B30F8256F96260EF48780FC415B2E94DD3797DE3CE5058748
                                Function 00007FF698EE3F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON
                                Download Yara Rule

                                Control-flow Graph

                                APIs
                                • GetModuleFileNameW.KERNEL32(?,00007FF698EE39CA), ref: 00007FF698EE3F34
                                  • Part of subcall function 00007FF698EE29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF698EE8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE29F4
                                  • Part of subcall function 00007FF698EE29C0: MessageBoxW.USER32 ref: 00007FF698EE2AD0
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorFileLastMessageModuleName
                                • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                • API String ID: 2581892565-1977442011
                                • Opcode ID: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
                                • Instruction ID: cc0eb11f490d7bd4962ff752512ee1486d8db7bacd7589c399883ed59936cd1c
                                • Opcode Fuzzy Hash: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
                                • Instruction Fuzzy Hash: EB115E21B1C54345FA319B31E8213FA5264EF487C5FC014B6E84EC769AEE3CE644C708
                                Function 00007FF698EFDD10 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                Download Yara Rule
                                APIs
                                • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF698EFDCFB), ref: 00007FF698EFDE2C
                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF698EFDCFB), ref: 00007FF698EFDEB7
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ConsoleErrorLastMode
                                • String ID:
                                • API String ID: 953036326-0
                                • Opcode ID: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
                                • Instruction ID: 2998d0b0efe9b65e8dcc6814d818eb37cfcf137c253e891b34e88dc38430ae70
                                • Opcode Fuzzy Hash: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
                                • Instruction Fuzzy Hash: C891C232F1865285F7709F35A4506BD2BA1FB64B88F9441B9DE0E97A84CF38E441D708
                                Function 00007FF698F004DC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _get_daylight$_isindst
                                • String ID:
                                • API String ID: 4170891091-0
                                • Opcode ID: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
                                • Instruction ID: 656006e2405775b3620b4b16a3c21311575e2855426cef2e2f92a7fa2ed24751
                                • Opcode Fuzzy Hash: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
                                • Instruction Fuzzy Hash: 3751E273F056118AEB34CF349955ABC2662EB90398F902175ED1ED3AE5EF38A4428704
                                Function 00007FF698EF6044 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                • String ID:
                                • API String ID: 2780335769-0
                                • Opcode ID: bf9e299d8a19087a057b397dc8e4afdf64a098b67ef913149ee4b49067ca2483
                                • Instruction ID: 265ef130fb041e058aa8c3471c23531044eba5da17966d7ca0da8b038f1393ad
                                • Opcode Fuzzy Hash: bf9e299d8a19087a057b397dc8e4afdf64a098b67ef913149ee4b49067ca2483
                                • Instruction Fuzzy Hash: A3519122E086418AF720DFB0E9603BD33B1EF64B98F509575EE0D8769ADF38D5449748
                                Function 00007FF698EF5EF0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 1279662727-0
                                • Opcode ID: 83590a85ef91dfeaaf5391bcb7c84269641a6271a066e8b030d9dbe54c1e2ad9
                                • Instruction ID: 1a838a03b15c29cc154825c9d886dcb59d6ab6642d8bf967f15f665e1a5c5187
                                • Opcode Fuzzy Hash: 83590a85ef91dfeaaf5391bcb7c84269641a6271a066e8b030d9dbe54c1e2ad9
                                • Instruction Fuzzy Hash: C541A122D1C78283E7648B30A5603796760FFB57A4F509374EA9C83AD1DF7CA5E09708
                                Function 00007FF698EEC3CC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                • String ID:
                                • API String ID: 3251591375-0
                                • Opcode ID: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
                                • Instruction ID: e31c16c133721b1e6f580c228fcb2821e4a28b01b038f54017ec6650dd574f77
                                • Opcode Fuzzy Hash: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
                                • Instruction Fuzzy Hash: ED313821E2824745FA34EB74A4723B92291EF51784FC410B5EA0ECB6D7DE3CB949834C
                                Function 00007FF698EFA7E4 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Process$CurrentExitTerminate
                                • String ID:
                                • API String ID: 1703294689-0
                                • Opcode ID: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
                                • Instruction ID: 273347b0b4836f70b6795b1d441c1115ef2f410b15cd9f2475b1d80cc94776ed
                                • Opcode Fuzzy Hash: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
                                • Instruction Fuzzy Hash: A2D09E20F1874246FA342F707CA95791211DF58B85F9064B8C84B8B393CD7CA44ED349
                                Function 00007FF698EE8D80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CreateDirectoryMessage
                                • String ID: Security descriptor is not initialized!
                                • API String ID: 73271072-986317556
                                • Opcode ID: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
                                • Instruction ID: 12925406973279f532a6594a05641aea5ce0245bd885aedb08619f53c4f21d00
                                • Opcode Fuzzy Hash: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
                                • Instruction Fuzzy Hash: 83E06D72A1878A86EA609F34E8142692290FBA5394FD013B4E14CC77E4DF7CD1098B04
                                Function 00007FF698EF0A6C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: cf177395047abfa4e851662a110b86e3e3c378c626585af56caf23d5c147307d
                                • Instruction ID: 1fcc6b6e72ea56b1b2dcaf03e2902da33e673ebf9eb5fb1bef09b8f39d7ac4b4
                                • Opcode Fuzzy Hash: cf177395047abfa4e851662a110b86e3e3c378c626585af56caf23d5c147307d
                                • Instruction Fuzzy Hash: 7451E871B0964146FA389F35B42067A6291EF64BA8F948770DE6DC77C5CF3CD800A708
                                Function 00007FF698EFB910 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                Download Yara Rule
                                APIs
                                • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF698EFB78D,?,?,00000000,00007FF698EFB842), ref: 00007FF698EFB97E
                                • GetLastError.KERNEL32(?,?,?,00007FF698EFB78D,?,?,00000000,00007FF698EFB842), ref: 00007FF698EFB988
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ChangeCloseErrorFindLastNotification
                                • String ID:
                                • API String ID: 1687624791-0
                                • Opcode ID: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
                                • Instruction ID: 60a7e6b17bb0e9b62b7fb031197b7d26337b4cd85792017fb74b2bb07cd0b2cc
                                • Opcode Fuzzy Hash: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
                                • Instruction Fuzzy Hash: 0E21D865B0868341FEB05735B5A027D2681DFA4BA4FD853B5DA6EC73C2CE7CE449A308
                                Function 00007FF698EFCEE4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorFileLastPointer
                                • String ID:
                                • API String ID: 2976181284-0
                                • Opcode ID: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
                                • Instruction ID: ff12687a55b1ef8e83ceae66213daf3de9aebd419723f236d8d22885550f01c0
                                • Opcode Fuzzy Hash: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
                                • Instruction Fuzzy Hash: 0011BF62618A9181DA208B35B414069B7A1EB54BF4FA85371EA7D8B7E9CF3CD0548708
                                Function 00007FF698EF61EC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                Download Yara Rule
                                APIs
                                • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF698EF6101), ref: 00007FF698EF621F
                                • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF698EF6101), ref: 00007FF698EF6235
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Time$System$FileLocalSpecific
                                • String ID:
                                • API String ID: 1707611234-0
                                • Opcode ID: 94d9743ddc59f1ec6d0c8066f19f46560215df41a9b86dc953b2c7251607b198
                                • Instruction ID: 6b442e93934886c79553a83a35d5505b3684a8b34f6b7d61bd5313d8ce5cf6aa
                                • Opcode Fuzzy Hash: 94d9743ddc59f1ec6d0c8066f19f46560215df41a9b86dc953b2c7251607b198
                                • Instruction Fuzzy Hash: 1711917260C60282EB748F64B41117AB770FB947A1FD01275E69DC69E8EF3CD044DB04
                                Function 00007FF698EF88E0 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF698EF875D), ref: 00007FF698EF8903
                                • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF698EF875D), ref: 00007FF698EF8919
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Time$System$FileLocalSpecific
                                • String ID:
                                • API String ID: 1707611234-0
                                • Opcode ID: 4ed2e9fa1167940cfa5aca87292fc65ce3ac60374052c1fe1dcdfc496945e827
                                • Instruction ID: 6bbda3886781e609f10ffc014452857adafe2c771e0e522555bd9ead69f9a8dd
                                • Opcode Fuzzy Hash: 4ed2e9fa1167940cfa5aca87292fc65ce3ac60374052c1fe1dcdfc496945e827
                                • Instruction Fuzzy Hash: F201A13250C26686E7708F24F41523AB3B1FB81B61FA01276E7AD869D8DF3CD000EB14
                                Function 00007FF698EFB700 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB716
                                • GetLastError.KERNEL32(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB720
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLanguagesLastPreferredRestoreThread
                                • String ID:
                                • API String ID: 588628887-0
                                • Opcode ID: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
                                • Instruction ID: f37a6ac7d2756dc69fdc546f51668ddb4b6c5a1bdddfb4be653957e88851a7bc
                                • Opcode Fuzzy Hash: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
                                • Instruction Fuzzy Hash: 19E08C25F0D60246FF386FB268A40351651CFA8B90BC851B0CD0DCB3D1DE3CA895A318
                                Function 00007FF698EF8ECC Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: DeleteErrorFileLast
                                • String ID:
                                • API String ID: 2018770650-0
                                • Opcode ID: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
                                • Instruction ID: 2c02c7619f69e87d0f63086245d859ce053a677b017e56a913b9d16f4104c169
                                • Opcode Fuzzy Hash: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
                                • Instruction Fuzzy Hash: FDD01224F2850785E6342BB12C950381294EF64760FE10BF0C02EC21D0DE7CA085671D
                                Function 00007FF698EF8648 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: DirectoryErrorLastRemove
                                • String ID:
                                • API String ID: 377330604-0
                                • Opcode ID: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
                                • Instruction ID: 144105c83698d4cbd90c35b52007a258318ea5cb6857dfe7e4ab96162deb8d9c
                                • Opcode Fuzzy Hash: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
                                • Instruction Fuzzy Hash: 24D01220F1954389E6342BB52C554382190EFA4771FD10AB4C03EC21D0DE7CA045671A
                                Function 00007FF698EE7F50 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00007FF698EE8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF698EE2A9B), ref: 00007FF698EE8E1A
                                • _findclose.LIBCMT ref: 00007FF698EE81A9
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ByteCharMultiWide_findclose
                                • String ID:
                                • API String ID: 2772937645-0
                                • Opcode ID: aa2a36deec39c3a11ec2b62d31fe43dc86d3decf01d493f1b5c8a3539a39b282
                                • Instruction ID: e9719dc47cd07581190a2f5a6f89c77d73f6d4e70257ff7b80cc2c5f97266063
                                • Opcode Fuzzy Hash: aa2a36deec39c3a11ec2b62d31fe43dc86d3decf01d493f1b5c8a3539a39b282
                                • Instruction Fuzzy Hash: 20717B52E18AC981EA21CB2CD5152FD6360F7A9B4CF94E321DB9C52593EF38E2D9C704
                                Function 00007FF698EFCC5C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: 1d9ce192a3da46ea8a65def934b56c452277ca90c934615c4cd3a21602e95038
                                • Instruction ID: 0abf4e2e43875aa476be151ccedd6c46b56bd51c34857367b6753d8dbc757380
                                • Opcode Fuzzy Hash: 1d9ce192a3da46ea8a65def934b56c452277ca90c934615c4cd3a21602e95038
                                • Instruction Fuzzy Hash: F8411432A0921183EA34CB38F06027D77A0EB66B80FA411B1D68EC36D1CF3DE502D749
                                Function 00007FF698EE84C0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _fread_nolock
                                • String ID:
                                • API String ID: 840049012-0
                                • Opcode ID: 1d5c224ee41389395c85bf280a5ef420999a42d25b7edcdbd34f59e3fba015ff
                                • Instruction ID: 69ef961535764336492bf9865bb60e5bff8502e4e9a96f71420b4c0fc9d0572b
                                • Opcode Fuzzy Hash: 1d5c224ee41389395c85bf280a5ef420999a42d25b7edcdbd34f59e3fba015ff
                                • Instruction Fuzzy Hash: 41217E21B096AA45FA609B32B9247FAA651FF55BD4FC84470EE0D877C6DE3CE045C708
                                Function 00007FF698EFC6EC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: 9d46e4dc1c7706e1baa247f93764384ede75e9bcf433252d370e5f4900f7c3d5
                                • Instruction ID: 8fa8dd3716a844c81d4ddb617dd3f1a785476b2f4d49175322cd980680cc81bb
                                • Opcode Fuzzy Hash: 9d46e4dc1c7706e1baa247f93764384ede75e9bcf433252d370e5f4900f7c3d5
                                • Instruction Fuzzy Hash: CA31C122E08A6291FB219B35A8613782A50EF70B91FE102B5DE1D873D2CF7CE441E759
                                Function 00007FF698EFA715 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: HandleModule$AddressFreeLibraryProc
                                • String ID:
                                • API String ID: 3947729631-0
                                • Opcode ID: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
                                • Instruction ID: 5f2b659b501e41559d72077d5a3e8eb613e2079712d924ad0cdb162135bca7ad
                                • Opcode Fuzzy Hash: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
                                • Instruction Fuzzy Hash: 3B21AE36E04B0689EB248F74E490AEC37B0EB5471CF94067ADA1D8AAC5DF38D585D784
                                Function 00007FF698EF69E4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
                                • Instruction ID: 9dd7ae537abbf566c0da9a69b228d581b5500e8dcd87e913f05668b153b5cb4f
                                • Opcode Fuzzy Hash: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
                                • Instruction Fuzzy Hash: F711A821A1D68142EAB09F31B421279A3A4FFA5B80FD440B1EA8DD77A5CF3DD510A748
                                Function 00007FF698F0748C Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
                                • Instruction ID: 4863c7ba6b7ef59ed66d4f559c90d5e9323ab220c517a92b074db75f8a9107e2
                                • Opcode Fuzzy Hash: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
                                • Instruction Fuzzy Hash: 9C21D732A18A418ADB718F38E44037977A0EB94BD4FA45274E65EC76D5DF3DD8108B04
                                Function 00007FF698EF0CEC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
                                • Instruction ID: 06907588467b0b8bd90490d1c129cc5f58feb57e79fea73cc11b9fc7d2ca3618
                                • Opcode Fuzzy Hash: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
                                • Instruction Fuzzy Hash: 8001A921A0874542E9249F7264100796695EB65FE0F8845B1DE5CD77DADF3DE5015304
                                Function 00007FF698EF82D4 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: 429e4ff91632884dbfd59807356ed260fa29108cd8906d3b6e9196ad5ea12367
                                • Instruction ID: 601d04f9d7c6b94f6d79d19ab81c81bec3231f8f8bf0efb57eb0b1f055111eae
                                • Opcode Fuzzy Hash: 429e4ff91632884dbfd59807356ed260fa29108cd8906d3b6e9196ad5ea12367
                                • Instruction Fuzzy Hash: 2C018020E0E66680FE706B7176611396690EF687D4FD852B5E91DC36D6CF3CB482630D
                                Function 00007FF698EFF948 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF698EFC196,?,?,?,00007FF698EFB35B,?,?,00000000,00007FF698EFB5F6), ref: 00007FF698EFF99D
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: AllocateHeap
                                • String ID:
                                • API String ID: 1279760036-0
                                • Opcode ID: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
                                • Instruction ID: fd511dc6b862e647b3fe03f6c59d8ec80ef3c414f72971f1c8c6bf0d560d67a2
                                • Opcode Fuzzy Hash: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
                                • Instruction Fuzzy Hash: E5F04F16B09202A1FE755BB164743B55291DFA8B80FCC50B0C90EC63D5DE3CE481A319
                                Function 00007FF698EFE3AC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • RtlAllocateHeap.NTDLL(?,?,?,00007FF698EF1514,?,?,?,00007FF698EF2A26,?,?,?,?,?,00007FF698EF4019), ref: 00007FF698EFE3EA
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: AllocateHeap
                                • String ID:
                                • API String ID: 1279760036-0
                                • Opcode ID: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
                                • Instruction ID: c85624301c7fbc05bfa789c669a5258f313f3b57263a7eddca0e7fdacfbe16bc
                                • Opcode Fuzzy Hash: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
                                • Instruction Fuzzy Hash: EDF05E14F1F28745FE386B7268656755290CFA87A0F8812B0E92ECA2C1DE7CF441A319
                                Function 00007FF698EF8610 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: 5d337e270712d004679ba659ef610f4cb2fc78abe2ab3a8c8a6757f66acf180b
                                • Instruction ID: ff9dbff2c946c454758826da4cb1b959f5b92cfae04c81302f1da109feacb1ad
                                • Opcode Fuzzy Hash: 5d337e270712d004679ba659ef610f4cb2fc78abe2ab3a8c8a6757f66acf180b
                                • Instruction Fuzzy Hash: EAE0EC50E0961A52FE747BB066E25792121CF78340F9150B0DA298A383ED3C6844BB2A
                                Function 00007FF698EE85F0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: DirectoryErrorLastRemove
                                • String ID:
                                • API String ID: 377330604-0
                                • Opcode ID: b081b867af62e1502bd09a952f28b23a6342cded27452249318bab44c8c263ba
                                • Instruction ID: 855b797b7481e8d4ee5e748ff65b6bc37b9ee0492f7d7fd141ec2a6ce02bb35b
                                • Opcode Fuzzy Hash: b081b867af62e1502bd09a952f28b23a6342cded27452249318bab44c8c263ba
                                • Instruction Fuzzy Hash: CE419816D1CB9A81E7219B34E5212FD6360FBA5744F84A672DF8D821A3EF38A5D8C304

                                Non-executed Functions

                                Function 00007FF698EE53F0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: AddressProc
                                • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                • API String ID: 190572456-4266016200
                                • Opcode ID: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
                                • Instruction ID: 116d25581bebdab2d158ae1bb0fba49ae3798e6126832b7a29efc7948845db1c
                                • Opcode Fuzzy Hash: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
                                • Instruction Fuzzy Hash: F212A1B5A0EB0394FA75EF34A8A017423A1EF047D5FD465B5D80E87AA5EF7CB5488308
                                Function 00007FF698F04EFC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                • API String ID: 808467561-2761157908
                                • Opcode ID: c804c22466df2b92b362f5d1d066b057dea08e8c29dc99d8cb90910c2247e431
                                • Instruction ID: 476b32889579b24b341997531ecc20b047112cc2c5b4540e9a7ece7d09cd29e1
                                • Opcode Fuzzy Hash: c804c22466df2b92b362f5d1d066b057dea08e8c29dc99d8cb90910c2247e431
                                • Instruction Fuzzy Hash: 3EB2C072A182828FE7748F74D4407FD77A1FB587C8F906175DA0AA7A85DFB8A900CB44
                                Function 00007FF698EE8770 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                Download Yara Rule
                                APIs
                                • GetLastError.KERNEL32(00000000,00007FF698EE2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE8797
                                • FormatMessageW.KERNEL32 ref: 00007FF698EE87C6
                                • WideCharToMultiByte.KERNEL32 ref: 00007FF698EE881C
                                  • Part of subcall function 00007FF698EE29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF698EE8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE29F4
                                  • Part of subcall function 00007FF698EE29C0: MessageBoxW.USER32 ref: 00007FF698EE2AD0
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                • API String ID: 2920928814-2573406579
                                • Opcode ID: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
                                • Instruction ID: a80cf723a83cfe902f8ea8095aa4b3e6b2e17ae7e418149d9a6e698576977518
                                • Opcode Fuzzy Hash: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
                                • Instruction Fuzzy Hash: A2211D72A18A4685F7749F31E85427A6265FB88384FC42175EA8DC36A5EF3CE145C708
                                Function 00007FF698EEA76D Relevance: 12.0, Strings: 9, Instructions: 745COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                • API String ID: 0-2665694366
                                • Opcode ID: 63f3ffa9379e1e3dea1ad36e367ec88dcfea323b25a29ef61fa4fbcfb838a92b
                                • Instruction ID: bdc79ad1ac29be011ae46a8baeb5df8ec452c84db81143207d50b0f77a11e2b9
                                • Opcode Fuzzy Hash: 63f3ffa9379e1e3dea1ad36e367ec88dcfea323b25a29ef61fa4fbcfb838a92b
                                • Instruction Fuzzy Hash: B252F572A146A68BE7748F24D468B7E3BA9FB94340F41417DE64A97781DF3CD844CB04
                                Function 00007FF698EEC8BC Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                • String ID:
                                • API String ID: 3140674995-0
                                • Opcode ID: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
                                • Instruction ID: 96efebdb89f6b57e0698e1212634eb3515971443cce953b95cb8adbd33b75aff
                                • Opcode Fuzzy Hash: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
                                • Instruction Fuzzy Hash: FF313A72619A818AEB709F60E8503FD7364FB84744F84407ADA4E97B99EF3CD648C718
                                Function 00007FF698EFB3CC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                • String ID:
                                • API String ID: 1239891234-0
                                • Opcode ID: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
                                • Instruction ID: f7cfdfd048bac9ac867fda138885139008dc04067050743411a2e6303417871f
                                • Opcode Fuzzy Hash: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
                                • Instruction Fuzzy Hash: 3E317336618B8185EB70CF35E8502AE73A4FB88794F940176EA9D83B99EF3CD545CB04
                                Function 00007FF698F026C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: FileFindFirst_invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 2227656907-0
                                • Opcode ID: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
                                • Instruction ID: 89ab5adca9dbfd37ed46da3c1588ea1f1c98f4347fc7f8ca16a491d1cecdd803
                                • Opcode Fuzzy Hash: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
                                • Instruction Fuzzy Hash: 4FB11636B1868645EE72DF71A4102B96391EB84BE4F942172ED4D87BC9DF3CE440D318
                                Function 00007FF698EEC7A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                • String ID:
                                • API String ID: 2933794660-0
                                • Opcode ID: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
                                • Instruction ID: f44df3be2e84430748b041035b17d6d0d0c583f17d8f7e78d1f5fdf963201775
                                • Opcode Fuzzy Hash: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
                                • Instruction Fuzzy Hash: CF111832B14B058AEB10CF70E8542B833A4FB19B98F842E71DA6D87BA4DF7CE1548344
                                Function 00007FF698F04A60 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: memcpy_s
                                • String ID:
                                • API String ID: 1502251526-0
                                • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                • Instruction ID: 7adff605e2ab36af146ed9c5e41c33510cc5c439a40bd700bdabfd438250cd63
                                • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                • Instruction Fuzzy Hash: BAC1F572B196858BD734CF26A04467AB791F7A4BC8F849135DB4A83744DF3DE841CB44
                                Function 00007FF698EE9F3B Relevance: 4.1, Strings: 3, Instructions: 397COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: $header crc mismatch$unknown header flags set
                                • API String ID: 0-1127688429
                                • Opcode ID: a8b055446104684f1ad95e328151202d31fdc591d47a14639da6131c49358b20
                                • Instruction ID: 574a2868b3640597188ce4d10f0b53e77557e5f67ab1d4dc4170101ccbc3862c
                                • Opcode Fuzzy Hash: a8b055446104684f1ad95e328151202d31fdc591d47a14639da6131c49358b20
                                • Instruction Fuzzy Hash: 73F1A172A183C54BEBB59B24C0A8E3E3AE9FF54740F4545B8DA4A97392CF38E940C744
                                Function 00007FF698F0A7D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ExceptionRaise_clrfp
                                • String ID:
                                • API String ID: 15204871-0
                                • Opcode ID: 107d115b060fbd35a116a220a90c3f58689526778be32960ff8b0eb29206904d
                                • Instruction ID: 0dad3c5aace2a12d60e44c4875ff3c3ad087fccb4dfd78dd8a34f5c0d8788df7
                                • Opcode Fuzzy Hash: 107d115b060fbd35a116a220a90c3f58689526778be32960ff8b0eb29206904d
                                • Instruction Fuzzy Hash: 25B16973A04B89CEEB25CF39C8463687BA0F784B88F559961DA5D837A4CF39D451C704
                                Function 00007FF698EF42D4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: $
                                • API String ID: 0-227171996
                                • Opcode ID: a4155c6fffaecf52a824239c2b6f37dbc1b24f1087258a4a4fa2a9ab421e67c4
                                • Instruction ID: 719367292244496f3739b876c90562e11c82ae40982d5c80f901f4a3d5a0b9a4
                                • Opcode Fuzzy Hash: a4155c6fffaecf52a824239c2b6f37dbc1b24f1087258a4a4fa2a9ab421e67c4
                                • Instruction Fuzzy Hash: 16E1D272A0964683EB788F3AA06013D33A0FF65B4CF944275CA1E83794DF39E951E748
                                Function 00007FF698EE9D9B Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: incorrect header check$invalid window size
                                • API String ID: 0-900081337
                                • Opcode ID: 7b159ed6ab11f424a85810e34fe73a423a8b15e185d016247a9cbb34ea0f7710
                                • Instruction ID: ecfb6e2dac582393f819c9ee4359e88624551f4a93629569129afdfada0c88ed
                                • Opcode Fuzzy Hash: 7b159ed6ab11f424a85810e34fe73a423a8b15e185d016247a9cbb34ea0f7710
                                • Instruction Fuzzy Hash: C991D372A182C687E7B58F24D4ACB3E3AE9FB84344F514179DA4A96791DF3CE940CB04
                                Function 00007FF698EFECA0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: e+000$gfff
                                • API String ID: 0-3030954782
                                • Opcode ID: b0eb00ec9cc72bcbd25ebaa9050c7cd18c6ed420f4824bc0d073d86035fcaeec
                                • Instruction ID: e3ea02cc76acd2b1ef082068dabc864d90cea77449bd0434fc85e6873315b27a
                                • Opcode Fuzzy Hash: b0eb00ec9cc72bcbd25ebaa9050c7cd18c6ed420f4824bc0d073d86035fcaeec
                                • Instruction Fuzzy Hash: C1517966B183C246E7308F35B8207697B91E7A8B94F88D271DB5C8BAC5CF7EE4448704
                                Function 00007FF698EFE80C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: gfffffff
                                • API String ID: 0-1523873471
                                • Opcode ID: ce984bed762576d5ac079d260fe98dbb5d2c0c9497d8241e3c95b971abe0b5e7
                                • Instruction ID: 491503d5ecb4aa9fa3a6d4ade9dffaf29a7e3ca6261898b4a5b6767ab3584497
                                • Opcode Fuzzy Hash: ce984bed762576d5ac079d260fe98dbb5d2c0c9497d8241e3c95b971abe0b5e7
                                • Instruction Fuzzy Hash: DBA14763B087C686EB31CF35A4207A97B91EB68B84F448071EE8D8B795DE3DE501D705
                                Function 00007FF698EF8EF4 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID: TMP
                                • API String ID: 3215553584-3125297090
                                • Opcode ID: 227a240b370b15b1266a0cc9d4416acc6519c25bf7b5095cb295345a6af5b08f
                                • Instruction ID: 9cbeb88b825f871e44fa827f296e36a5daa5cbf4c8ad6d12ef6e09f8065ac96e
                                • Opcode Fuzzy Hash: 227a240b370b15b1266a0cc9d4416acc6519c25bf7b5095cb295345a6af5b08f
                                • Instruction Fuzzy Hash: 5951E515F0C31A45FA74AB36AA2117A5291EFA5BC4F8850B5DE4DC77C6EE3CE442A308
                                Function 00007FF698F042D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: HeapProcess
                                • String ID:
                                • API String ID: 54951025-0
                                • Opcode ID: ed995d9d252c3e0c61107ed1ba5c48f1392176915e7fcf845d28b2722b2e2d45
                                • Instruction ID: 75f2e6aa123a9006adbe2a4b275ff86b5e1f5649e917a7a90528ea31b767018d
                                • Opcode Fuzzy Hash: ed995d9d252c3e0c61107ed1ba5c48f1392176915e7fcf845d28b2722b2e2d45
                                • Instruction Fuzzy Hash: 12B09230E07A42CAFA182B216CC221462A4BF48751FD450B9C00D83320DE3C20A68715
                                Function 00007FF698EF3ED0 Relevance: .3, Instructions: 327COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: ca9df69fd1c27fd416770dca946a20fccf44885df857cf64186a4c680355c85b
                                • Instruction ID: c12e87a5da148dc586f4b74a99728a8d28a8c90ec0f91aff206a143dcefcdcc8
                                • Opcode Fuzzy Hash: ca9df69fd1c27fd416770dca946a20fccf44885df857cf64186a4c680355c85b
                                • Instruction Fuzzy Hash: DDD1E222A0860283FB38CF36A16027D27A0FF65B4CF9442B5CE0D87695CF39E841E349
                                Function 00007FF698EE92D0 Relevance: .3, Instructions: 287COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: a6d76246942c46f132312ebc4a4bc27c309f6729675ee6fb805fd22939f347a0
                                • Instruction ID: abde6fd49c716c468d8526fc1ef0ebb38d2d1ce7024bdf90f95ad366d685d954
                                • Opcode Fuzzy Hash: a6d76246942c46f132312ebc4a4bc27c309f6729675ee6fb805fd22939f347a0
                                • Instruction Fuzzy Hash: 9EC1B4722141E14BD2D9EB29E46957E77E1F78934DBC4403AEB8B47B8ACA3CE114D710
                                Function 00007FF698EF3540 Relevance: .2, Instructions: 241COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: fa501f5897fa8170c1c3089a9165536d111e8d2735d862654f88cabfcab8bd87
                                • Instruction ID: 0aa4d745397ad95b9caf066b8cbd59dc50e67ba7f725805893eae25bf4833a92
                                • Opcode Fuzzy Hash: fa501f5897fa8170c1c3089a9165536d111e8d2735d862654f88cabfcab8bd87
                                • Instruction Fuzzy Hash: 6CB1AE72A0878585E7768F39E06023D3BA0E769F48FA541B9CE4E87395CF39D841E748
                                Function 00007FF698EFF320 Relevance: .2, Instructions: 198COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: dde3b387bb0edac5d3a7572aaf71fcdce3ba0ac9d1c4353072e234eccf42a557
                                • Instruction ID: 552d98ebd36b45e7667107bb21e08d30c64e9277b0d4a0827cb2845d61dea914
                                • Opcode Fuzzy Hash: dde3b387bb0edac5d3a7572aaf71fcdce3ba0ac9d1c4353072e234eccf42a557
                                • Instruction Fuzzy Hash: 9581F073A0C38146EB74CF29B06037AAA91FBA5794F844275DB9D83B99CE3CE4009B04
                                Function 00007FF698F07550 Relevance: .2, Instructions: 183COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID:
                                • API String ID: 3215553584-0
                                • Opcode ID: 0545a2559c330c3b8b837ff60ad1fca552f4247d75f95da319e64bf11632f5cd
                                • Instruction ID: 100bb9b6f6ac27b442da6e725b8988889c096bcaac1eb458be53b0d50017f962
                                • Opcode Fuzzy Hash: 0545a2559c330c3b8b837ff60ad1fca552f4247d75f95da319e64bf11632f5cd
                                • Instruction Fuzzy Hash: FA61E732F192824AFB748E3894546796681EF903E0FD516F5D61FC76D2EE7EE8008708
                                Function 00007FF698EF2A94 Relevance: .1, Instructions: 146COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 431273df7c005eff8b086499786a7f8af66af839407972891033f6f8b32510fa
                                • Instruction ID: de5e594a30eb7bd9efd38513cc39bc561595db3fe9243b892dbb742ff70b2401
                                • Opcode Fuzzy Hash: 431273df7c005eff8b086499786a7f8af66af839407972891033f6f8b32510fa
                                • Instruction Fuzzy Hash: 12518376A18A5286E7348F39E06423837A0EB64F68FA44171CE4D977D4CF3AE843E744
                                Function 00007FF698EF2274 Relevance: .1, Instructions: 146COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 3986d2e28db3ad4c814196551e744b7f12e089580c78501851383343d29f5119
                                • Instruction ID: 111a2cd8f97d95375d21972f720f045e52643b4aaf7a91511b66cacb4d7d6a55
                                • Opcode Fuzzy Hash: 3986d2e28db3ad4c814196551e744b7f12e089580c78501851383343d29f5119
                                • Instruction Fuzzy Hash: 2251A376A1965282E7348B39E06023837A0FB65F68FE44171CE4D87794CF3AE843E748
                                Function 00007FF698EF2684 Relevance: .1, Instructions: 146COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 0a7def00a57181835e1b5755574f212d41c435eb46ac8bcc91c00ca4f50edce3
                                • Instruction ID: f80f87ed23b6c9fb07e4d1283bbafe209046df9f5805269ff6b2c699107b9aa6
                                • Opcode Fuzzy Hash: 0a7def00a57181835e1b5755574f212d41c435eb46ac8bcc91c00ca4f50edce3
                                • Instruction Fuzzy Hash: C4518476A18A5186E7348B39E06023837A1EB64B68FE44171CE4D877E4CF3AEC43E744
                                Function 00007FF698EF2480 Relevance: .1, Instructions: 145COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 5b37b721d2520797c932084b48cf8e5c5b4bbfd8b4955e3aae9fbd8879836657
                                • Instruction ID: b07446ca45f1e14970ecf032625cbbf709993fe19967d04651c14493bbf7e9b0
                                • Opcode Fuzzy Hash: 5b37b721d2520797c932084b48cf8e5c5b4bbfd8b4955e3aae9fbd8879836657
                                • Instruction Fuzzy Hash: DD51A376A1865186E7348B39E06023837A1EBA4F59FE44171CE4C977A4CF3AEC43E748
                                Function 00007FF698EF2890 Relevance: .1, Instructions: 145COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 56eab1984f79c1160248cb97b5e30aec2666dd062f10dae5dc3084fdbc1595d5
                                • Instruction ID: 92f39030ce8fb3f55a9500ec5ebf0ca50f3a8199717351d3898363d0e317cea7
                                • Opcode Fuzzy Hash: 56eab1984f79c1160248cb97b5e30aec2666dd062f10dae5dc3084fdbc1595d5
                                • Instruction Fuzzy Hash: 69519636A18A5585E7358B39E06027837A1EBA4F58FE44171CE8C97798CF3AE843E744
                                Function 00007FF698EF2070 Relevance: .1, Instructions: 145COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e4a792dd5f357ba9ab053cb868b8428acf2d0115ad083e523ed5123ef832f09c
                                • Instruction ID: 94fab6436c24160424a4ccd282af38c3c039a2b8d1b1d6487f1c513d1c0eb73d
                                • Opcode Fuzzy Hash: e4a792dd5f357ba9ab053cb868b8428acf2d0115ad083e523ed5123ef832f09c
                                • Instruction Fuzzy Hash: 4E51C537A18A5186E7348B38E46023837A0EB65B58FE441B1DE4C97795CF3AEC43D748
                                Function 00007FF698EF6750 Relevance: .1, Instructions: 138COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                • Instruction ID: 49e43aa6d13fc07c46cc74850a963ea16167d1c936995a34f61263f76da2f9c2
                                • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                • Instruction Fuzzy Hash: 3741C892C0D7CA07E9754B3855206B45A80EF327A0DD852F8CC9AD73E3ED2D6587E309
                                Function 00007FF698EFAC50 Relevance: .1, Instructions: 126COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLanguagesLastPreferredRestoreThread
                                • String ID:
                                • API String ID: 588628887-0
                                • Opcode ID: f111dc0bb75c4fd458f0a84966b8cb0fe478d08570652a426d7f95957c6d4c4f
                                • Instruction ID: 4a766397a8f6b5e9adbd4fc63b50898a2c6a4a741952eae250ca1a7654c9e488
                                • Opcode Fuzzy Hash: f111dc0bb75c4fd458f0a84966b8cb0fe478d08570652a426d7f95957c6d4c4f
                                • Instruction Fuzzy Hash: AD410372714A5582EF14CF3AE964569B3A1FB58FD4B88A032DE0DD7B58DE3DD0428304
                                Function 00007FF698EF84BC Relevance: .1, Instructions: 98COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: e0b9409b015bea46d2036294c0136b3200ade656a83a3c77deb383565566a918
                                • Instruction ID: 8f88e3dff7ef77188c6fb8876058670de6887be74d7ff357d4e3332959f73f61
                                • Opcode Fuzzy Hash: e0b9409b015bea46d2036294c0136b3200ade656a83a3c77deb383565566a918
                                • Instruction Fuzzy Hash: 4D31E232B08B9282E7349F35795017E6695EF85BE0F544278EA8E97BD6DF3CD0129308
                                Function 00007FF698F0A620 Relevance: .0, Instructions: 32COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: c3f3f1020485e8a41a296fc930dbc96221e618d45f39aaa63d951921bdf06b5a
                                • Instruction ID: bc3d36d35816fef6b6302a105c11ad8a7d69b5819a6e20d4a79c3978baf1fb35
                                • Opcode Fuzzy Hash: c3f3f1020485e8a41a296fc930dbc96221e618d45f39aaa63d951921bdf06b5a
                                • Instruction Fuzzy Hash: DEF06271B192968ADBA88F39A80262977E0F7083C0F809579E68DC7B04DA3D94619F08
                                Function 00007FF698EECA9C Relevance: .0, Instructions: 2COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: b04046989d87c8dc885ed01c2b3f2aaa9c0b13633c97905e42662c4d2108a614
                                • Instruction ID: f53530b787b423c2becb632d2b3bae26f921cc0f4084022d4f2f6a0d561491c7
                                • Opcode Fuzzy Hash: b04046989d87c8dc885ed01c2b3f2aaa9c0b13633c97905e42662c4d2108a614
                                • Instruction Fuzzy Hash: A9A00161A18842D4E674CB20A8610302220EB51389B8110B2D12E924A1EE3CA4418308
                                Function 00007FF698EE7100 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: AddressProc
                                • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                • API String ID: 190572456-2208601799
                                • Opcode ID: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
                                • Instruction ID: d6341f16d24b2c6ee12dc0972350fa64fc1072eec29b3b621100108910958a9d
                                • Opcode Fuzzy Hash: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
                                • Instruction Fuzzy Hash: 6AE1B0B5A1DB0395FA798F24B8A417423A6EF08790BD464F5D80E872A5EFBCF544830C
                                Function 00007FF698EE12A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message_fread_nolock
                                • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                • API String ID: 3065259568-2316137593
                                • Opcode ID: ae90d1d2cc2d25e3c28b24c58b246aacc49f8053e7d38ab1b4092be4bbb44153
                                • Instruction ID: 30c3fa56b5f901b347a795a5a3cdf7a3437415b9bca27a1607c7e418b888c348
                                • Opcode Fuzzy Hash: ae90d1d2cc2d25e3c28b24c58b246aacc49f8053e7d38ab1b4092be4bbb44153
                                • Instruction Fuzzy Hash: 16517E61B0968286EB30AB31A8616FA6294EF547C4FD040B1EE4DC7B96EE7CE5459308
                                Function 00007FF698EE23D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                • String ID: P%
                                • API String ID: 2147705588-2959514604
                                • Opcode ID: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
                                • Instruction ID: d09dc577853093fa7ecb453c0639675002b43036722e6ad7cecc61bc20d829eb
                                • Opcode Fuzzy Hash: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
                                • Instruction Fuzzy Hash: 93511436618BA186D6389F32E4181BAB7A1FB98BA5F404121EFCF83685DF3CD045DB14
                                Function 00007FF698EF6CE0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID: -$:$f$p$p
                                • API String ID: 3215553584-2013873522
                                • Opcode ID: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
                                • Instruction ID: 7eba1b5b52a46e5834ed77a0b597d7a877398f12dfa6da33531fb7a8f7ae641d
                                • Opcode Fuzzy Hash: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
                                • Instruction Fuzzy Hash: B212A422A0D18386FB309B34F8646797662FB60754FD48075E68B876C4DF3DE984AB1C
                                Function 00007FF698EF18F8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID: f$f$p$p$f
                                • API String ID: 3215553584-1325933183
                                • Opcode ID: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
                                • Instruction ID: 4ae4bae047d24d561e978f6018fe2ae8b31824b565f2e8e1440883be87ec0d9b
                                • Opcode Fuzzy Hash: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
                                • Instruction Fuzzy Hash: C912D672E0C18B86FB359B35F0642797661FBA0750FD44176E69A87AC4DF3CE480AB08
                                Function 00007FF698EE1590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message
                                • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                • API String ID: 2030045667-3659356012
                                • Opcode ID: 0deee378f0e0dbbcba27be8de59613c71a3704f45a05304d8fde90f21704b714
                                • Instruction ID: 958d0c6c80350bbdda32d5cab131ad9b46a08c7e6f84d47102b16b6aa5e55d1e
                                • Opcode Fuzzy Hash: 0deee378f0e0dbbcba27be8de59613c71a3704f45a05304d8fde90f21704b714
                                • Instruction Fuzzy Hash: EB31A021B0864386FF31AF22E4201BA6390EF54BC4FD85471DE4D87A96EE3CE5459308
                                Function 00007FF698EEF330 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                • String ID: csm$csm$csm
                                • API String ID: 849930591-393685449
                                • Opcode ID: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
                                • Instruction ID: fc05f835dea5a377e61cc3c6e8b5e71bb371c019acab78e942dd27813b031bb0
                                • Opcode Fuzzy Hash: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
                                • Instruction Fuzzy Hash: 2DD17D33A08B4286EB309F7594902BD37A0FB55798F9001B5EE8D97B9ADF38E590C744
                                Function 00007FF698EE89B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                Download Yara Rule
                                APIs
                                • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE8A47
                                • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE8A9E
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ByteCharMultiWide
                                • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                • API String ID: 626452242-27947307
                                • Opcode ID: 400f0bdcbd62a4a5536486c2f7426be13d95d078f8c38135e0fc09a91e7db9c0
                                • Instruction ID: d8727e01b32dfe3de6323581b9b03cdf1aa2053b5a52f47eafa69774ad469ed8
                                • Opcode Fuzzy Hash: 400f0bdcbd62a4a5536486c2f7426be13d95d078f8c38135e0fc09a91e7db9c0
                                • Instruction Fuzzy Hash: 0541DD32A0CB9A82E670CF21B85017AB7A1FB84B90F985575EE8D87B95DF3CD441C708
                                Function 00007FF698EE8EF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                Download Yara Rule
                                APIs
                                • WideCharToMultiByte.KERNEL32(?,00007FF698EE39CA), ref: 00007FF698EE8F31
                                  • Part of subcall function 00007FF698EE29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF698EE8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE29F4
                                  • Part of subcall function 00007FF698EE29C0: MessageBoxW.USER32 ref: 00007FF698EE2AD0
                                • WideCharToMultiByte.KERNEL32(?,00007FF698EE39CA), ref: 00007FF698EE8FA5
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ByteCharMultiWide$ErrorLastMessage
                                • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                • API String ID: 3723044601-27947307
                                • Opcode ID: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
                                • Instruction ID: 3b68fd6943473d1bfb43a890704ea309be85965fd78a28039d434be42a3af37a
                                • Opcode Fuzzy Hash: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
                                • Instruction Fuzzy Hash: 9F215C31B0DB4A99EB209F36A850079B662EB84BD0F985575DA4D83795EF3CE541C308
                                Function 00007FF698EE77B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo$_fread_nolock
                                • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                • API String ID: 3231891352-3501660386
                                • Opcode ID: 2be27f9cd969ff962ba60c53aa7374ee1e35d43e53d67819a9def324665be43e
                                • Instruction ID: a2bd8a739801d310f72a9c25870afc20cd9f257e5118985ac1cf8791b586eb97
                                • Opcode Fuzzy Hash: 2be27f9cd969ff962ba60c53aa7374ee1e35d43e53d67819a9def324665be43e
                                • Instruction Fuzzy Hash: FE51AC21A0D64245FB30AB35A9642B96291DF95BC0FC540B1EA8EC77DBEE3DE900830C
                                Function 00007FF698EEE3C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF698EEE67A,?,?,?,00007FF698EED5AC,?,?,?,00007FF698EED1A1), ref: 00007FF698EEE44D
                                • GetLastError.KERNEL32(?,?,?,00007FF698EEE67A,?,?,?,00007FF698EED5AC,?,?,?,00007FF698EED1A1), ref: 00007FF698EEE45B
                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF698EEE67A,?,?,?,00007FF698EED5AC,?,?,?,00007FF698EED1A1), ref: 00007FF698EEE485
                                • FreeLibrary.KERNEL32(?,?,?,00007FF698EEE67A,?,?,?,00007FF698EED5AC,?,?,?,00007FF698EED1A1), ref: 00007FF698EEE4F3
                                • GetProcAddress.KERNEL32(?,?,?,00007FF698EEE67A,?,?,?,00007FF698EED5AC,?,?,?,00007FF698EED1A1), ref: 00007FF698EEE4FF
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Library$Load$AddressErrorFreeLastProc
                                • String ID: api-ms-
                                • API String ID: 2559590344-2084034818
                                • Opcode ID: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
                                • Instruction ID: 383c7a69ae0c24d1739d4676d2dc9c7dd7aff4a0881d81f1374b284b9b687685
                                • Opcode Fuzzy Hash: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
                                • Instruction Fuzzy Hash: B131C231B1AA4395EE31DB66A4105B523D4FF44BA0F990575EE1DC7B95EF3CE4808308
                                Function 00007FF698EE7630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00007FF698EE8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF698EE2A9B), ref: 00007FF698EE8E1A
                                • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF698EE7BB1,00000000,?,00000000,00000000,?,00007FF698EE153F), ref: 00007FF698EE768F
                                  • Part of subcall function 00007FF698EE2B10: MessageBoxW.USER32 ref: 00007FF698EE2BE5
                                Strings
                                • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF698EE7666
                                • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF698EE76EA
                                • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF698EE76A3
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                • API String ID: 1662231829-3498232454
                                • Opcode ID: 9bfcf0b62ea921097bc7abb589b6718567d9e6fafddd2668cb98e057143b44d0
                                • Instruction ID: e8c8167c1ead9f031aa7cb57afeed106df52a7a428562a2f39f9f296a59fc38e
                                • Opcode Fuzzy Hash: 9bfcf0b62ea921097bc7abb589b6718567d9e6fafddd2668cb98e057143b44d0
                                • Instruction Fuzzy Hash: 67313E51B2D68241FB34AB35A9652BA5291EF987C1FC404B2DA4EC36D7EE7CE5048708
                                Function 00007FF698EE8DE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                Download Yara Rule
                                APIs
                                • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF698EE2A9B), ref: 00007FF698EE8E1A
                                  • Part of subcall function 00007FF698EE29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF698EE8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE29F4
                                  • Part of subcall function 00007FF698EE29C0: MessageBoxW.USER32 ref: 00007FF698EE2AD0
                                • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF698EE2A9B), ref: 00007FF698EE8EA0
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ByteCharMultiWide$ErrorLastMessage
                                • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                • API String ID: 3723044601-876015163
                                • Opcode ID: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
                                • Instruction ID: 8c2b8157d9f834f7466e3cb74ffb692dbb09fbd564f0f95fd4a9a5f3cbb3ae19
                                • Opcode Fuzzy Hash: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
                                • Instruction Fuzzy Hash: 1F216032B08A5681EB60CF39F851179A3A1FB887C4F984571DB4CC3BAAEE3DD5518708
                                Function 00007FF698EFBF00 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Value$ErrorLast
                                • String ID:
                                • API String ID: 2506987500-0
                                • Opcode ID: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
                                • Instruction ID: 93f31097af87d38047b888ebfebe626b3be97499b71fd1696eddb6aa6f523475
                                • Opcode Fuzzy Hash: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
                                • Instruction Fuzzy Hash: C7217F2AB0C24242FA786331B9751796562DFA47F0FA447B4E87EC7AC6DE3CB4006708
                                Function 00007FF698F08D9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                • String ID: CONOUT$
                                • API String ID: 3230265001-3130406586
                                • Opcode ID: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
                                • Instruction ID: 87674746b86b8ff1a498ece0058aca10e0c71688539d30bea08c033e5bc56472
                                • Opcode Fuzzy Hash: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
                                • Instruction Fuzzy Hash: EF119032B18A418AE3608F62E84432962A4FB88FE4F906274EE1DC7794CF3CD544C748
                                Function 00007FF698EFC078 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • GetLastError.KERNEL32(?,?,?,00007FF698EF5CBD,?,?,?,?,00007FF698EFF9AF,?,?,00000000,00007FF698EFC196,?,?,?), ref: 00007FF698EFC087
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EF5CBD,?,?,?,?,00007FF698EFF9AF,?,?,00000000,00007FF698EFC196,?,?,?), ref: 00007FF698EFC0BD
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EF5CBD,?,?,?,?,00007FF698EFF9AF,?,?,00000000,00007FF698EFC196,?,?,?), ref: 00007FF698EFC0EA
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EF5CBD,?,?,?,?,00007FF698EFF9AF,?,?,00000000,00007FF698EFC196,?,?,?), ref: 00007FF698EFC0FB
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EF5CBD,?,?,?,?,00007FF698EFF9AF,?,?,00000000,00007FF698EFC196,?,?,?), ref: 00007FF698EFC10C
                                • SetLastError.KERNEL32(?,?,?,00007FF698EF5CBD,?,?,?,?,00007FF698EFF9AF,?,?,00000000,00007FF698EFC196,?,?,?), ref: 00007FF698EFC127
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Value$ErrorLast
                                • String ID:
                                • API String ID: 2506987500-0
                                • Opcode ID: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
                                • Instruction ID: a6877ca0e3b1eeccf4e7def68fd8691f4a678fc32406d000f3777cbf5485bd2b
                                • Opcode Fuzzy Hash: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
                                • Instruction Fuzzy Hash: F5119025F0C25242FA749731B6711796162DFA57F0FA447B4E92EC76C6DE3CB4416308
                                Function 00007FF698EE25E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                • String ID: Unhandled exception in script
                                • API String ID: 3081866767-2699770090
                                • Opcode ID: 035139a28c932b525dc7cac8fcdac5569ee169202821a797d5d04823a4addf63
                                • Instruction ID: edcc2d46d83579e4a369adee235a737e98a16e558fc8706947bc44d8db542c66
                                • Opcode Fuzzy Hash: 035139a28c932b525dc7cac8fcdac5569ee169202821a797d5d04823a4addf63
                                • Instruction Fuzzy Hash: 53313C76A08A8289EB20DF31E8551F96360FF89784F840176EA4D87A9ADF3CD105C704
                                Function 00007FF698EE29C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON
                                Download Yara Rule
                                APIs
                                • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF698EE8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE29F4
                                  • Part of subcall function 00007FF698EE8770: GetLastError.KERNEL32(00000000,00007FF698EE2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF698EE101D), ref: 00007FF698EE8797
                                  • Part of subcall function 00007FF698EE8770: FormatMessageW.KERNEL32 ref: 00007FF698EE87C6
                                  • Part of subcall function 00007FF698EE8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF698EE2A9B), ref: 00007FF698EE8E1A
                                • MessageBoxW.USER32 ref: 00007FF698EE2AD0
                                • MessageBoxA.USER32 ref: 00007FF698EE2AEC
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                • String ID: %s%s: %s$Fatal error detected
                                • API String ID: 2806210788-2410924014
                                • Opcode ID: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
                                • Instruction ID: 0094a595ae72ed15eabf35298cfd787f21d31a600ed4eaef01791551514a9d66
                                • Opcode Fuzzy Hash: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
                                • Instruction Fuzzy Hash: 1F318372628A8681E730DB20F4516EA6364FF847C4FC05176E6CD83A99DF3CD605CB44
                                Function 00007FF698EFA83C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: AddressFreeHandleLibraryModuleProc
                                • String ID: CorExitProcess$mscoree.dll
                                • API String ID: 4061214504-1276376045
                                • Opcode ID: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
                                • Instruction ID: c2cf715c47f131d2bc49e47a3a2e133dfb9c210e158fd4fd9ca4cbd2e49c40d9
                                • Opcode Fuzzy Hash: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
                                • Instruction Fuzzy Hash: 7CF0AF71A09A4281FA348F34B4987392320EF48BA5FD41279D66D8A2E0DF3CD049D304
                                Function 00007FF698F0A420 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _set_statfp
                                • String ID:
                                • API String ID: 1156100317-0
                                • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                • Instruction ID: 6fe64cd653828962d7fe4e9ec23a6101c0f03e14e2120e3013e848cf9231f43a
                                • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                • Instruction Fuzzy Hash: AC11C47EE1CA0309FA741974E44AB796141EF653F0ED426B5E56ECF2F79E2C6850410C
                                Function 00007FF698EFC140 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                Download Yara Rule
                                APIs
                                • FlsGetValue.KERNEL32(?,?,?,00007FF698EFB35B,?,?,00000000,00007FF698EFB5F6,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFC15F
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EFB35B,?,?,00000000,00007FF698EFB5F6,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFC17E
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EFB35B,?,?,00000000,00007FF698EFB5F6,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFC1A6
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EFB35B,?,?,00000000,00007FF698EFB5F6,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFC1B7
                                • FlsSetValue.KERNEL32(?,?,?,00007FF698EFB35B,?,?,00000000,00007FF698EFB5F6,?,?,?,?,?,00007FF698EF38BC), ref: 00007FF698EFC1C8
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Value
                                • String ID:
                                • API String ID: 3702945584-0
                                • Opcode ID: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
                                • Instruction ID: 5725633b156ec2ed66147b676f70a399377d615c00aabc21c33e58e57070adb3
                                • Opcode Fuzzy Hash: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
                                • Instruction Fuzzy Hash: 45116D61F0825202FA789331B9612795161DFA43F0FA453B4E83EC76C6DE3CB411A308
                                Function 00007FF698EFBFD4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Value
                                • String ID:
                                • API String ID: 3702945584-0
                                • Opcode ID: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
                                • Instruction ID: fdb3f6897ada0f986fe87ccef70b17f341d35f3f3907740916d65233b9555edd
                                • Opcode Fuzzy Hash: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
                                • Instruction Fuzzy Hash: 0211E825E4821742F978A335B4712B91152CFA63B4EE857B4D93ECA2D6DD3DB442630C
                                Function 00007FF698EF69F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID: verbose
                                • API String ID: 3215553584-579935070
                                • Opcode ID: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
                                • Instruction ID: 15c9d1b855b15cf5b603444a435b9e6f8475cbb6294046625ed6038daece4cc8
                                • Opcode Fuzzy Hash: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
                                • Instruction Fuzzy Hash: 5691C122A08A4642F7719F35E86037D37A1EB60B54FC442B6DA9D873E5DE3CE445A348
                                Function 00007FF698F00AA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _invalid_parameter_noinfo
                                • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                • API String ID: 3215553584-1196891531
                                • Opcode ID: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
                                • Instruction ID: 169f17a21440eaf9fe00520cecb813aeb358ebf9de00b81aa0b660025b7082dd
                                • Opcode Fuzzy Hash: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
                                • Instruction Fuzzy Hash: C9818D73E0C6428DFB758E39815027836A0EB91BC8FD5A0B5DA0ED7295DF3DE801970A
                                Function 00007FF698EECF80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                • String ID: csm
                                • API String ID: 2395640692-1018135373
                                • Opcode ID: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
                                • Instruction ID: 11a8b0237d93586d4a3249663d2af6a646d12897451ea99ebdab8f7d83cfee94
                                • Opcode Fuzzy Hash: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
                                • Instruction Fuzzy Hash: F451D432F196028ADB24CF29E464A7D3392EB45B98F948171DA4D87786DF7DE841C704
                                Function 00007FF698EEF800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CallEncodePointerTranslator
                                • String ID: MOC$RCC
                                • API String ID: 3544855599-2084237596
                                • Opcode ID: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
                                • Instruction ID: 145f762f54b6f3683ebf9cd5ee0dbcb4101f88344f20fa7c755f62e6b1a50abe
                                • Opcode Fuzzy Hash: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
                                • Instruction Fuzzy Hash: 7C619133908BC582E7719B25E4507BAB7A0FB84794F844265EB9D87B96DF3CE190CB04
                                Function 00007FF698EEFBB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                • String ID: csm$csm
                                • API String ID: 3896166516-3733052814
                                • Opcode ID: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
                                • Instruction ID: fb99559fc253c3c7010a50fe7d3f7d4719447cf69347065bee2a53fa19026a5d
                                • Opcode Fuzzy Hash: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
                                • Instruction Fuzzy Hash: 00518E3390828286EB748B3594643787BA0FB54B84FA441B6DE8D87BC6CF3CE461C709
                                Function 00007FF698EE2870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message$ByteCharMultiWide
                                • String ID: %s%s: %s$Fatal error detected
                                • API String ID: 1878133881-2410924014
                                • Opcode ID: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
                                • Instruction ID: 62fa77d0d53680e5ccc1f263ec31fcede68b386243945fd87a128e695959b242
                                • Opcode Fuzzy Hash: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
                                • Instruction Fuzzy Hash: 4A319272628A8291E630DB20F4516EAA364FF947C4FC05176E7CD87A9ADF3CD605CB44
                                Function 00007FF698EE4340 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67fileCOMMON
                                Download Yara Rule
                                APIs
                                  • Part of subcall function 00007FF698EE8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF698EE2A9B), ref: 00007FF698EE8E1A
                                • CreateFileW.KERNEL32(00000000,?,?,00007FF698EE3FB9,?,00007FF698EE39CA), ref: 00007FF698EE43A8
                                • GetFinalPathNameByHandleW.KERNEL32(?,?,00007FF698EE3FB9,?,00007FF698EE39CA), ref: 00007FF698EE43C8
                                • CloseHandle.KERNEL32(?,?,00007FF698EE3FB9,?,00007FF698EE39CA), ref: 00007FF698EE43D3
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Handle$ByteCharCloseCreateFileFinalMultiNamePathWide
                                • String ID: \\?\
                                • API String ID: 2226452419-4282027825
                                • Opcode ID: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
                                • Instruction ID: 07bafdd8c524fcf0be2720b4687a7c279d07bdad914b4d33355714bc607432ad
                                • Opcode Fuzzy Hash: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
                                • Instruction Fuzzy Hash: C221A072B18A5146E730DB31F8543A96251EB887D4F841271DF4D83B99DE3CD548CB08
                                Function 00007FF698EFD350 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: FileWrite$ConsoleErrorLastOutput
                                • String ID:
                                • API String ID: 2718003287-0
                                • Opcode ID: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
                                • Instruction ID: b1b9a0230e0893b97ebe2254686d2366ffebac9a06d082eae5ae3d7273034921
                                • Opcode Fuzzy Hash: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
                                • Instruction Fuzzy Hash: B8D10E72F08A8189E721CF75E4502AC3BA6FB657D8B844275DE5DDBB89DE38E406C304
                                Function 00007FF698EE2310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: LongWindow$DialogInvalidateRect
                                • String ID:
                                • API String ID: 1956198572-0
                                • Opcode ID: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
                                • Instruction ID: aa995d459bb2826520fb9be44a127ce8e015bb0dfd12f56d16067c4a9e908ad6
                                • Opcode Fuzzy Hash: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
                                • Instruction Fuzzy Hash: E7118231E1854342FB649F79F5542BD1292EB88BC0FC89071EA4987B9ACE7CD8C54B08
                                Function 00007FF698F06A6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: _get_daylight$_invalid_parameter_noinfo
                                • String ID: ?
                                • API String ID: 1286766494-1684325040
                                • Opcode ID: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
                                • Instruction ID: 8247375657127631a2309b7b5fba93cdbebb8f8c1b75e3cc415d082f6ebb0db1
                                • Opcode Fuzzy Hash: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
                                • Instruction Fuzzy Hash: 2C411672A08B828AFB349F35A41137A6690EB90BE4F945275EE5C87AD9DF3CD441C704
                                Function 00007FF698EF9DC8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                Download Yara Rule
                                APIs
                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF698EF9DFA
                                  • Part of subcall function 00007FF698EFB700: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB716
                                  • Part of subcall function 00007FF698EFB700: GetLastError.KERNEL32(?,?,?,00007FF698F03B72,?,?,?,00007FF698F03BAF,?,?,00000000,00007FF698F04075,?,?,00000000,00007FF698F03FA7), ref: 00007FF698EFB720
                                • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF698EEC335), ref: 00007FF698EF9E18
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                • String ID: C:\Users\user\Desktop\Colby Dupe Script.exe
                                • API String ID: 2553983749-1448296548
                                • Opcode ID: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
                                • Instruction ID: cdaa79a0d48274c380c88c03630cfa0fe8e662d4790006c7bac7636ecaf90dda
                                • Opcode Fuzzy Hash: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
                                • Instruction Fuzzy Hash: F1419F36A08B4286EB34EF35E4A00B82794EB947D4F945076E98EC7B85DF3CE4819308
                                Function 00007FF698EFD9E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorFileLastWrite
                                • String ID: U
                                • API String ID: 442123175-4171548499
                                • Opcode ID: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
                                • Instruction ID: 9279bdd8b6b7fe6dcdb11d56e7698792c9b74dd2763a2eac9d9483f350154b7b
                                • Opcode Fuzzy Hash: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
                                • Instruction Fuzzy Hash: 24418E72B18A8286DB208F25E8543AAA7A0FB987D4F844131EE4DC7798EF3CD541D748
                                Function 00007FF698F00108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: CurrentDirectory
                                • String ID: :
                                • API String ID: 1611563598-336475711
                                • Opcode ID: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
                                • Instruction ID: 4fadb4c9e65e64559f4eecfbea5c541156bf53f55bfad8b1ba9e7dfbe32885c6
                                • Opcode Fuzzy Hash: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
                                • Instruction Fuzzy Hash: D121CE33A08681C5EB308F21D45426D63A2FBC4B84FD58076DA8DC3284DF7CE9458744
                                Function 00007FF698EE2B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message$ByteCharMultiWide
                                • String ID: Fatal error detected
                                • API String ID: 1878133881-4025702859
                                • Opcode ID: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
                                • Instruction ID: 5cdbc7f32943079288ed3d4607fd1da8fb956121e91f5809d7e0d1bbde49b00c
                                • Opcode Fuzzy Hash: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
                                • Instruction Fuzzy Hash: B421837262868691E730DB20F4516EAA364FF947C8FC05176E68D87AA9DF3CD205CB04
                                Function 00007FF698EE2C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Message$ByteCharMultiWide
                                • String ID: Error detected
                                • API String ID: 1878133881-3513342764
                                • Opcode ID: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
                                • Instruction ID: 491a51c2d63ef54f1388146027734d9bf0390f32d2bd80be6c6dd95ae1e89909
                                • Opcode Fuzzy Hash: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
                                • Instruction Fuzzy Hash: BD21957262868691E730DB20F4516EAA364FF947C4FC05176EB8D87A99DF3CD205CB04
                                Function 00007FF698EF0678 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ExceptionFileHeaderRaise
                                • String ID: csm
                                • API String ID: 2573137834-1018135373
                                • Opcode ID: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
                                • Instruction ID: b5adc37d5f50080df14731bd2c3551892795555e9665d51acc19356470a43547
                                • Opcode Fuzzy Hash: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
                                • Instruction Fuzzy Hash: 62116D32608B8182EB20CF25F41026977E1FB98B88F994270DE8D87B68DF3CC951CB04
                                Function 00007FF698F01594 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000000.00000002.1733704667.00007FF698EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF698EE0000, based on PE: true
                                • Associated: 00000000.00000002.1733686102.00007FF698EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733730182.00007FF698F0C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733754159.00007FF698F21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                • Associated: 00000000.00000002.1733790962.00007FF698F23000.00000002.00000001.01000000.00000003.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_0_2_7ff698ee0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: DriveType_invalid_parameter_noinfo
                                • String ID: :
                                • API String ID: 2595371189-336475711
                                • Opcode ID: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
                                • Instruction ID: 71594e727111cbd969db4ee1286cd4c6eee5e7fa52ba4bef0d24aa2ab7eba811
                                • Opcode Fuzzy Hash: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
                                • Instruction Fuzzy Hash: 2D01847291C6428AF7309F70A46127E63A0EF55788FC02475D58ECB695EF3CE544D718

                                Execution Graph

                                Execution Coverage:0.3%
                                Dynamic/Decrypted Code Coverage:0%
                                Signature Coverage:50%
                                Total number of Nodes:16
                                Total number of Limit Nodes:2
                                execution_graph 101918 7ffdfb413230 101923 7ffdfb413dd1 101918->101923 101926 7ffdfb413248 101918->101926 101919 7ffdfb413cde LoadLibraryA 101920 7ffdfb413cf8 101919->101920 101924 7ffdfb413d17 GetProcAddress 101920->101924 101920->101926 101922 7ffdfb413d39 VirtualProtect VirtualProtect 101922->101923 101923->101923 101924->101920 101925 7ffdfb413d2e 101924->101925 101926->101919 101926->101922 101927 7ffdfae12340 101928 7ffdfae12f3e 101927->101928 101931 7ffdfae12358 101927->101931 101929 7ffdfae12e57 LoadLibraryA 101930 7ffdfae12e71 101929->101930 101930->101931 101932 7ffdfae12e7a GetProcAddress 101930->101932 101931->101929 101935 7ffdfae12ea6 VirtualProtect VirtualProtect 101931->101935 101932->101930 101934 7ffdfae12e9b 101932->101934 101935->101928

                                Executed Functions

                                Function 00007FFDFAE12340 Relevance: 6.9, APIs: 4, Instructions: 896librarymemoryloaderCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726427603.00007FFDFAE12000.00000080.00000001.01000000.00000031.sdmp, Offset: 00007FFDFABD0000, based on PE: true
                                • Associated: 00000001.00000002.1726006615.00007FFDFABD0000.00000002.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFABD1000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFADAA000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFADBA000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFADCF000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFADF3000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFADFB000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFADFD000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726025426.00007FFDFAE10000.00000040.00000001.01000000.00000031.sdmpDownload File
                                • Associated: 00000001.00000002.1726446480.00007FFDFAE14000.00000004.00000001.01000000.00000031.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfabd0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ProtectVirtual$AddressLibraryLoadProc
                                • String ID:
                                • API String ID: 3300690313-0
                                • Opcode ID: cafc77c72beb4bd53c6e3c8a1b7038cc46def87aa34a7a02fca3f610377cff5a
                                • Instruction ID: 88fc8fbdca579bf21ee20750015ff91f8a3c2c0454d307c232f38b0219575337
                                • Opcode Fuzzy Hash: cafc77c72beb4bd53c6e3c8a1b7038cc46def87aa34a7a02fca3f610377cff5a
                                • Instruction Fuzzy Hash: DA6258227281A29BE7199F38D8106BD7790FB58785F445531EAAFC37C8EA3DEA45C700
                                Function 00007FFDFB413230 Relevance: 6.8, APIs: 4, Instructions: 850librarymemoryloaderCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ProtectVirtual$AddressLibraryLoadProc
                                • String ID:
                                • API String ID: 3300690313-0
                                • Opcode ID: 6912a145b092a435b2690e8e050799ca64382d8315b3fc9a28e3f91c66e0900d
                                • Instruction ID: c4aaa606c348c303bad07f9b25fbb7857e2d8b64cc30abfdf889492f023678e5
                                • Opcode Fuzzy Hash: 6912a145b092a435b2690e8e050799ca64382d8315b3fc9a28e3f91c66e0900d
                                • Instruction Fuzzy Hash: C7622962B29192A6E716CF38D61077D77A0F748789F046531EAAEC37D8E63CEA45C700
                                Function 00007FFDFAF4F820 Relevance: 1.7, APIs: 1, Instructions: 213COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 431 7ffdfaf4f820-7ffdfaf4f84e GetSystemInfo call 7ffdfaff8620 433 7ffdfaf4f853-7ffdfaf4f855 431->433 434 7ffdfaf4f8f0-7ffdfaf4f8f7 call 7ffdfaff8620 433->434 435 7ffdfaf4f85b-7ffdfaf4f861 433->435 444 7ffdfaf4f9b4-7ffdfaf4f9bb call 7ffdfaff8620 434->444 445 7ffdfaf4f8fd-7ffdfaf4f903 434->445 436 7ffdfaf4f863-7ffdfaf4f865 435->436 437 7ffdfaf4f867-7ffdfaf4f878 435->437 439 7ffdfaf4f883-7ffdfaf4f894 436->439 437->439 451 7ffdfaf4f87a 437->451 441 7ffdfaf4f89f-7ffdfaf4f8a2 439->441 442 7ffdfaf4f896-7ffdfaf4f89d 439->442 448 7ffdfaf4f8d4-7ffdfaf4f8e5 441->448 449 7ffdfaf4f8a4-7ffdfaf4f8ac 441->449 442->448 462 7ffdfaf4f9c1-7ffdfaf4f9c7 444->462 463 7ffdfaf4fa74-7ffdfaf4fa7b call 7ffdfaff8620 444->463 446 7ffdfaf4f909-7ffdfaf4f91a 445->446 447 7ffdfaf4f905-7ffdfaf4f907 445->447 452 7ffdfaf4f925-7ffdfaf4f936 446->452 464 7ffdfaf4f91c 446->464 447->452 448->434 456 7ffdfaf4f8e7 448->456 453 7ffdfaf4f8c3-7ffdfaf4f8c7 449->453 454 7ffdfaf4f8ae 449->454 451->439 459 7ffdfaf4f948-7ffdfaf4f94b 452->459 460 7ffdfaf4f938-7ffdfaf4f946 452->460 453->448 461 7ffdfaf4f8c9-7ffdfaf4f8d0 453->461 458 7ffdfaf4f8b2-7ffdfaf4f8b5 454->458 456->434 458->453 465 7ffdfaf4f8b7-7ffdfaf4f8c1 458->465 467 7ffdfaf4f94d-7ffdfaf4f955 459->467 468 7ffdfaf4f998-7ffdfaf4f99f 459->468 466 7ffdfaf4f982-7ffdfaf4f985 460->466 461->448 469 7ffdfaf4f9cd-7ffdfaf4f9de 462->469 470 7ffdfaf4f9c9-7ffdfaf4f9cb 462->470 480 7ffdfaf4fa81-7ffdfaf4fa87 463->480 481 7ffdfaf4fb34-7ffdfaf4fb40 463->481 464->452 465->453 465->458 466->468 472 7ffdfaf4f987-7ffdfaf4f996 466->472 475 7ffdfaf4f971-7ffdfaf4f975 467->475 476 7ffdfaf4f957-7ffdfaf4f95b 467->476 474 7ffdfaf4f9a6-7ffdfaf4f9a9 468->474 477 7ffdfaf4f9e9-7ffdfaf4f9fa 469->477 494 7ffdfaf4f9e0 469->494 470->477 472->474 474->444 482 7ffdfaf4f9ab 474->482 475->466 485 7ffdfaf4f977-7ffdfaf4f97e 475->485 483 7ffdfaf4f960-7ffdfaf4f963 476->483 478 7ffdfaf4fa0c-7ffdfaf4fa0f 477->478 479 7ffdfaf4f9fc-7ffdfaf4fa0a 477->479 487 7ffdfaf4fa11-7ffdfaf4fa19 478->487 488 7ffdfaf4fa58-7ffdfaf4fa5f 478->488 486 7ffdfaf4fa42-7ffdfaf4fa45 479->486 489 7ffdfaf4fa8d-7ffdfaf4fa9e 480->489 490 7ffdfaf4fa89-7ffdfaf4fa8b 480->490 491 7ffdfaf4fb42-7ffdfaf4fb53 481->491 492 7ffdfaf4fb54-7ffdfaf4fb6c 481->492 482->444 483->475 493 7ffdfaf4f965-7ffdfaf4f96f 483->493 485->466 486->488 498 7ffdfaf4fa47-7ffdfaf4fa56 486->498 495 7ffdfaf4fa31-7ffdfaf4fa35 487->495 496 7ffdfaf4fa1b-7ffdfaf4fa1f 487->496 499 7ffdfaf4fa66-7ffdfaf4fa69 488->499 497 7ffdfaf4faa9-7ffdfaf4faba 489->497 508 7ffdfaf4faa0 489->508 490->497 493->475 493->483 494->477 495->486 502 7ffdfaf4fa37-7ffdfaf4fa3e 495->502 500 7ffdfaf4fa20-7ffdfaf4fa23 496->500 503 7ffdfaf4facc-7ffdfaf4facf 497->503 504 7ffdfaf4fabc-7ffdfaf4faca 497->504 498->499 499->463 506 7ffdfaf4fa6b 499->506 500->495 507 7ffdfaf4fa25-7ffdfaf4fa2f 500->507 502->486 510 7ffdfaf4fad1-7ffdfaf4fad9 503->510 511 7ffdfaf4fb18-7ffdfaf4fb1f 503->511 509 7ffdfaf4fb02-7ffdfaf4fb05 504->509 506->463 507->495 507->500 508->497 509->511 512 7ffdfaf4fb07-7ffdfaf4fb16 509->512 514 7ffdfaf4faf1-7ffdfaf4faf5 510->514 515 7ffdfaf4fadb-7ffdfaf4fadf 510->515 513 7ffdfaf4fb26-7ffdfaf4fb29 511->513 512->513 513->481 517 7ffdfaf4fb2b 513->517 514->509 516 7ffdfaf4faf7-7ffdfaf4fafe 514->516 518 7ffdfaf4fae0-7ffdfaf4fae3 515->518 516->509 517->481 518->514 519 7ffdfaf4fae5-7ffdfaf4faef 518->519 519->514 519->518
                                APIs
                                • GetSystemInfo.KERNEL32(?,?,?,?,00007FFDFAFF890C,?,?,?,?,00007FFDFAF485DD,?,?,?,?,00007FFDFAF74567), ref: 00007FFDFAF4F848
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: InfoSystem
                                • String ID:
                                • API String ID: 31276548-0
                                • Opcode ID: 75f1db212b269ba8466c8530d3d4b3f45e34fba6d528fb4c6e7acba09ac25192
                                • Instruction ID: eb35c47fc932750ad572add09c2ef7e20b4d50d28f396748ae658b732b849397
                                • Opcode Fuzzy Hash: 75f1db212b269ba8466c8530d3d4b3f45e34fba6d528fb4c6e7acba09ac25192
                                • Instruction Fuzzy Hash: 43A10721F0AB4381FF588B56E830A7522A0BF46BA8F440675DD6E4A3E8DF7CE6559310
                                Function 00007FFDFAFF8620 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 320COMMON
                                Download Yara Rule

                                Control-flow Graph

                                • Executed
                                • Not Executed
                                control_flow_graph 295 7ffdfaff8620-7ffdfaff862b 296 7ffdfaff8635-7ffdfaff8643 call 7ffdfaf44c70 295->296 297 7ffdfaff862d-7ffdfaff8634 295->297 300 7ffdfaff8649-7ffdfaff865c 296->300 301 7ffdfaff8ba8-7ffdfaff8bb1 296->301 302 7ffdfaff8662-7ffdfaff8673 300->302 303 7ffdfaff865e-7ffdfaff8660 300->303 304 7ffdfaff867e-7ffdfaff868e 302->304 308 7ffdfaff8675 302->308 303->304 306 7ffdfaff8725-7ffdfaff8739 304->306 307 7ffdfaff8694-7ffdfaff869b 304->307 311 7ffdfaff873b-7ffdfaff8742 306->311 312 7ffdfaff8752 306->312 309 7ffdfaff86ae-7ffdfaff86b5 307->309 310 7ffdfaff869d-7ffdfaff86a9 call 7ffdfaff8c70 307->310 308->304 317 7ffdfaff86bc 309->317 318 7ffdfaff86b7-7ffdfaff86ba 309->318 310->309 313 7ffdfaff88cb-7ffdfaff88e7 311->313 314 7ffdfaff8748-7ffdfaff874b 311->314 315 7ffdfaff8758-7ffdfaff875b 312->315 313->312 327 7ffdfaff88ed-7ffdfaff88f0 313->327 314->312 320 7ffdfaff876d-7ffdfaff876f 315->320 321 7ffdfaff875d-7ffdfaff8766 315->321 319 7ffdfaff86c7-7ffdfaff86d5 317->319 318->319 323 7ffdfaff86eb-7ffdfaff86f2 319->323 324 7ffdfaff86d7-7ffdfaff86e1 319->324 325 7ffdfaff8b9c-7ffdfaff8ba3 320->325 326 7ffdfaff8775-7ffdfaff8778 320->326 321->320 332 7ffdfaff86f8-7ffdfaff8709 323->332 324->323 329 7ffdfaff86e3-7ffdfaff86e9 324->329 325->301 330 7ffdfaff877a-7ffdfaff8780 326->330 331 7ffdfaff8787-7ffdfaff878d 326->331 327->312 335 7ffdfaff88f6-7ffdfaff88f9 327->335 329->323 329->332 330->331 333 7ffdfaff8b43-7ffdfaff8b46 331->333 334 7ffdfaff8793-7ffdfaff8799 331->334 332->306 342 7ffdfaff870b-7ffdfaff8723 332->342 338 7ffdfaff8b48-7ffdfaff8b4e 333->338 339 7ffdfaff8b55-7ffdfaff8b58 333->339 334->333 337 7ffdfaff879f-7ffdfaff8818 00007FFE146319C0 call 7ffdfafa5d40 * 5 334->337 335->315 361 7ffdfaff881a-7ffdfaff8824 337->361 362 7ffdfaff884f-7ffdfaff8860 call 7ffdfaff8620 337->362 338->339 343 7ffdfaff8b6a-7ffdfaff8b7a 339->343 344 7ffdfaff8b5a-7ffdfaff8b63 339->344 342->315 347 7ffdfaff8b7c-7ffdfaff8b7f 343->347 348 7ffdfaff8b8e-7ffdfaff8b91 343->348 344->343 352 7ffdfaff8b87 347->352 353 7ffdfaff8b81 347->353 348->325 349 7ffdfaff8b93 348->349 349->325 352->348 353->352 364 7ffdfaff883c-7ffdfaff8849 361->364 365 7ffdfaff8826-7ffdfaff8835 call 7ffdfaff8c70 361->365 370 7ffdfaff8866-7ffdfaff8874 call 7ffdfaf45330 362->370 371 7ffdfaff8b31 362->371 364->362 372 7ffdfaff8b36-7ffdfaff8b3d 364->372 365->364 370->371 375 7ffdfaff887a-7ffdfaff8880 370->375 371->372 372->333 376 7ffdfaff8882-7ffdfaff888c 375->376 377 7ffdfaff88fe 375->377 378 7ffdfaff8894-7ffdfaff88c1 376->378 379 7ffdfaff888e 376->379 380 7ffdfaff8907 call 7ffdfaf4f820 377->380 378->380 387 7ffdfaff88c3-7ffdfaff88c9 378->387 379->378 383 7ffdfaff890c-7ffdfaff8910 380->383 383->372 384 7ffdfaff8916-7ffdfaff891d call 7ffdfaff8620 383->384 389 7ffdfaff8b2a-7ffdfaff8b2f 384->389 390 7ffdfaff8923-7ffdfaff892a 384->390 387->380 389->372 392 7ffdfaff892c-7ffdfaff8933 390->392 393 7ffdfaff8935-7ffdfaff894b 390->393 394 7ffdfaff8974-7ffdfaff8977 392->394 398 7ffdfaff8968 393->398 399 7ffdfaff894d-7ffdfaff8966 393->399 394->389 395 7ffdfaff897d-7ffdfaff89a0 call 7ffdfaff8620 394->395 395->372 402 7ffdfaff89a6-7ffdfaff89ad 395->402 401 7ffdfaff896f 398->401 399->401 401->394 404 7ffdfaff89b4-7ffdfaff89c5 402->404 405 7ffdfaff89af-7ffdfaff89b2 402->405 406 7ffdfaff89d0-7ffdfaff89e1 404->406 411 7ffdfaff89c7 404->411 405->406 409 7ffdfaff89f3-7ffdfaff89f6 406->409 410 7ffdfaff89e3-7ffdfaff89f1 406->410 412 7ffdfaff89f8-7ffdfaff89ff 409->412 413 7ffdfaff8a3d-7ffdfaff8a44 409->413 414 7ffdfaff8a27-7ffdfaff8a2a 410->414 411->406 417 7ffdfaff8a16-7ffdfaff8a1a 412->417 418 7ffdfaff8a01 412->418 416 7ffdfaff8a4b-7ffdfaff8a4e 413->416 414->413 415 7ffdfaff8a2c-7ffdfaff8a3b 414->415 415->416 420 7ffdfaff8a59-7ffdfaff8a68 416->420 421 7ffdfaff8a50 416->421 417->414 419 7ffdfaff8a1c-7ffdfaff8a23 417->419 422 7ffdfaff8a05-7ffdfaff8a08 418->422 419->414 424 7ffdfaff8a6e-7ffdfaff8ab9 420->424 425 7ffdfaff8b1d-7ffdfaff8b28 420->425 421->420 422->417 423 7ffdfaff8a0a-7ffdfaff8a14 422->423 423->417 423->422 426 7ffdfaff8abb-7ffdfaff8ac8 424->426 427 7ffdfaff8aca-7ffdfaff8af1 424->427 425->372 429 7ffdfaff8af3-7ffdfaff8af8 426->429 428 7ffdfaff8b16 427->428 427->429 428->425 430 7ffdfaff8b00-7ffdfaff8b14 429->430 430->428 430->430
                                APIs
                                • 00007FFE146319C0.VCRUNTIME140(?,?,?,?,00007FFDFAF485DD,?,?,?,?,00007FFDFAF74567,?,?,?,?,?,00007FFDFAF4207B), ref: 00007FFDFAFF87B8
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: gfff
                                • API String ID: 1776107623-1553575800
                                • Opcode ID: fc0083de08274c5edd80eb5e96a5d3d50a5f3cba4e7f9cce6d4ea1fa2268eea6
                                • Instruction ID: bad0a15cde912caca23fe29870c805cca57fa377915067240e9e2b3f45170494
                                • Opcode Fuzzy Hash: fc0083de08274c5edd80eb5e96a5d3d50a5f3cba4e7f9cce6d4ea1fa2268eea6
                                • Instruction Fuzzy Hash: 62F1E960F1EB8795FB588B12A870E7423A0BF46B98F444275E92D4A3F9DF7CB441A740

                                Non-executed Functions

                                Function 00007FFDFB0C266C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: EnvironmentVariable$ByteCharMultiWide
                                • String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
                                • API String ID: 2184640988-1666712896
                                • Opcode ID: 419c88fdedd40b7a4bd6282dbefca93637e627fdfe4ba8766129e23dca955196
                                • Instruction ID: 3a6ba0fea00e21028ae4292584a7c3d4ea65823d984237f00e1361d2f291d93b
                                • Opcode Fuzzy Hash: 419c88fdedd40b7a4bd6282dbefca93637e627fdfe4ba8766129e23dca955196
                                • Instruction Fuzzy Hash: E661E72670AB8346EB109F21A56097967A1FF55BE4B588236DE7D837E8DF3DD00A8300
                                Function 00007FFDFAF6B910 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 427COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)$Failed to read ptrmap key=%d$Main freelist: $Page %d is never used$Pointer map page %d is referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%d) disagrees with header (%d)
                                • API String ID: 1776107623-2103957143
                                • Opcode ID: 1b56883e94786a4ef89848aa5daf97c28cb12df8ac01aa6718e35593c8ad7888
                                • Instruction ID: 6b31eba10bc7d19f9aeb6a758b524cd136f6139bb8326bb58f3a038ac4bfb0ef
                                • Opcode Fuzzy Hash: 1b56883e94786a4ef89848aa5daf97c28cb12df8ac01aa6718e35593c8ad7888
                                • Instruction Fuzzy Hash: 82129E32B097428AEB28CB65D464AA973A1FF45768F540275EE6D4BBE8CF3CE445C700
                                Function 00007FFDFAF4E040 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 399COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
                                • API String ID: 1776107623-463513059
                                • Opcode ID: 47cd6acc09cb97cf6b0c7df549a53dd8525139ec74fec1c94a40a24148967e6a
                                • Instruction ID: 42891d9ad0bc8f93b16c0826d697cabba0e21ed0874246555606906aaa6b1a2d
                                • Opcode Fuzzy Hash: 47cd6acc09cb97cf6b0c7df549a53dd8525139ec74fec1c94a40a24148967e6a
                                • Instruction Fuzzy Hash: 48E11351B1D3C707EF0C8B39A4219B86A919F5A790F484276EEBE4B7D5DE2CB612C700
                                Function 00007FFDFAE23048 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726484532.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                • Associated: 00000001.00000002.1726465722.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAE84000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAED3000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF2C000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF31000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF34000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726661849.00007FFDFAF35000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726679942.00007FFDFAF37000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfae20000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                • String ID:
                                • API String ID: 2350663779-0
                                • Opcode ID: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
                                • Instruction ID: 8ff86c469f87c212e8d0e74d1bb1bb4bfb9bd68f68878a42da4db9b35c9f03a0
                                • Opcode Fuzzy Hash: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
                                • Instruction Fuzzy Hash: 0B318F72B08A8285EB649F60E860BED73A0FB94744F440079DA5E47AD8DF3DC648CB10
                                Function 00007FFDFAF469A2 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 488COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: 0123456789ABCDEF0123456789abcdef$Inf$NaN$VUUU$gfff
                                • API String ID: 1776107623-2941899328
                                • Opcode ID: e0fc8c7b0d882bf01384680dcc055da3b179f8e9c85d86452f87d38abd0181c3
                                • Instruction ID: f9a7d24c23019371067e86217c1509f51bf65b5fe0332d11cfc74219a3f59f55
                                • Opcode Fuzzy Hash: e0fc8c7b0d882bf01384680dcc055da3b179f8e9c85d86452f87d38abd0181c3
                                • Instruction Fuzzy Hash: 68128D22F0CA8785E7AA8A35D060B7A6BA0FF55394F054371FE9D5B6D9DF2CE6418300
                                Function 00007FFDFB0C3229 Relevance: 12.3, APIs: 8, Instructions: 251fileCOMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ByteCharMultiWide$FileFind$00007ErrorF020FirstLastNext
                                • String ID:
                                • API String ID: 1171239525-0
                                • Opcode ID: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
                                • Instruction ID: af6b11d83ed5c022018b7dc72375ddca3dbe63484b552f889b2742244120df3c
                                • Opcode Fuzzy Hash: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
                                • Instruction Fuzzy Hash: AAB1B522B06A8389EB109F65D464A7967A1FF49BA4F544335DABD837F8EF3CD0458300
                                Function 00007FFDFB0C5A1F Relevance: 10.6, APIs: 7, Instructions: 73COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                • String ID:
                                • API String ID: 3140674995-0
                                • Opcode ID: 836932d6aed314119f7ddbe256598baef3b0bd20caf5fb751809a6c17d89e7ea
                                • Instruction ID: 04bbda177e0011a795172c32cb071bcd9f68aafe085389367c1b42d9692f4a66
                                • Opcode Fuzzy Hash: 836932d6aed314119f7ddbe256598baef3b0bd20caf5fb751809a6c17d89e7ea
                                • Instruction Fuzzy Hash: 4731417270AB8286EB609F60E8607ED7761FB84748F484039DB9D47AE9DF38D548C710
                                Function 00007FFDFAFBED10 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: database schema is locked: %s$out of memory$statement too long
                                • API String ID: 1776107623-1046679716
                                • Opcode ID: e232070af0714be8bfd0a6078d049f8658ffead47aa7b1c63900081b75c8633c
                                • Instruction ID: 14aa28eae24a10a29476a51461f55c75bece790c0fdc20e0bc97e3bea498c991
                                • Opcode Fuzzy Hash: e232070af0714be8bfd0a6078d049f8658ffead47aa7b1c63900081b75c8633c
                                • Instruction Fuzzy Hash: 22F16122B0868345FB289B21D464BBA67A0FF45BA4F044276EF6E4B6D9DF7CE541C310
                                Function 00007FFDFB0C2B5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLastbind
                                • String ID: ..\s\crypto\bio\b_sock2.c
                                • API String ID: 2328862993-3200932406
                                • Opcode ID: c767e834a84740a79c233dcad0d39ea44b2e2a28cfc1136448b175a4500b188a
                                • Instruction ID: 7ad7c1d1ef18cbda39718e7c2c809ef688490bf9bd85b5938ae50c2b56690b9a
                                • Opcode Fuzzy Hash: c767e834a84740a79c233dcad0d39ea44b2e2a28cfc1136448b175a4500b188a
                                • Instruction Fuzzy Hash: 0421BE62F1A55382E710DB21E810ABD6760FB82B88F400231EA6D03BEDDF3DE5469B00
                                Function 00007FFDFB0C572C Relevance: .0, Instructions: 22COMMON
                                Download Yara Rule
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID:
                                • API String ID:
                                • Opcode ID: 8b647e036b0e5ae8a118200442eb522906dc17efbe743a2891263b2f3e414abb
                                • Instruction ID: 611943784eb2208ffa2207ade6cde1b1b9e13f1c30f7f017d8fb8777f6b39f32
                                • Opcode Fuzzy Hash: 8b647e036b0e5ae8a118200442eb522906dc17efbe743a2891263b2f3e414abb
                                • Instruction Fuzzy Hash: B3E0DF73B193A505CB56CA336218E792A90A714BCDF43C030990DC3F99EF2EEA01CB40
                                Function 00007FFDFB273F10 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 223COMMON
                                Download Yara Rule
                                APIs
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273F61
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273F78
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273F8F
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB273FC2
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27400B
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27403F
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274091
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740A4
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740BB
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740CE
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740E5
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2740F8
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27410F
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274122
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274135
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB274148
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB27415B
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2741A7
                                • 00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB274B53,?,?,?,?,?,?,?,?,00007FFDFB272B8B), ref: 00007FFDFB2741D2
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007B5630
                                • String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
                                • API String ID: 2248877218-1119032718
                                • Opcode ID: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
                                • Instruction ID: 28b7de9c39eb919dd072d08f0239557a20dfdd7f222d59207967c111bf77a32c
                                • Opcode Fuzzy Hash: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
                                • Instruction Fuzzy Hash: 6B91DE10B8E65392FF50AB25A972A7827D1DF567E4F682130DC7EC22FDEE2CE4418204
                                Function 00007FFDFB0C4E3F Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 205registryfileCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite
                                • String ID: $OpenSSL$OpenSSL: FATAL$no stack?
                                • API String ID: 1270133462-2963566556
                                • Opcode ID: 4334f370b7a482bd35c4ecd3ae7f0d910e81077902a64c89114c2b2096981407
                                • Instruction ID: b436bdafdd630c2a3b8eec7c2d2c3013e3a7bef472abb8440c660461e6890879
                                • Opcode Fuzzy Hash: 4334f370b7a482bd35c4ecd3ae7f0d910e81077902a64c89114c2b2096981407
                                • Instruction Fuzzy Hash: CA91E373B09B8782EB209F24D8609F93760FB45B98F444235EA6D47AE9EF38D255C300
                                Function 00007FFDFB0C32AB Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 127COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007$A1370$B5630
                                • String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
                                • API String ID: 751195488-1596076588
                                • Opcode ID: 8e1608afc237cc655a59732373ba8e0b1afa52b80ee81b2eea672c0bd8193b25
                                • Instruction ID: 3dd54a642d34cfaa9859b598a765d4d83d7cdb2805a92865691d97f2e42fac35
                                • Opcode Fuzzy Hash: 8e1608afc237cc655a59732373ba8e0b1afa52b80ee81b2eea672c0bd8193b25
                                • Instruction Fuzzy Hash: 6251C362B0AA079AEB11AB56A830EB97391BF45B84F448031ED6E437FDDF3CE445D600
                                Function 00007FFDFAFB8320 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 382COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
                                • API String ID: 0-3733955532
                                • Opcode ID: b6d5a7562ca74dbbd21e233fc160e28895668a26162358da1cfac9be2dbcc32d
                                • Instruction ID: aaa4aad27349054167738cba004330048f079d023f107ee26686fde8e3582c1d
                                • Opcode Fuzzy Hash: b6d5a7562ca74dbbd21e233fc160e28895668a26162358da1cfac9be2dbcc32d
                                • Instruction Fuzzy Hash: B8027821B1A78385EF589F11D474AB92361EF86BE4F044276EE6E0A7E8DF2CF4459340
                                Function 00007FFDFAE22720 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                Download Yara Rule
                                APIs
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726484532.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                • Associated: 00000001.00000002.1726465722.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAE84000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAED3000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF2C000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF31000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF34000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726661849.00007FFDFAF35000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726679942.00007FFDFAF37000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfae20000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                • String ID:
                                • API String ID: 349153199-0
                                • Opcode ID: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
                                • Instruction ID: 0ae2b9c069bf07f84f120459723d166124cb25746a545bf04a3422a30a8d4bd8
                                • Opcode Fuzzy Hash: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
                                • Instruction Fuzzy Hash: 5D81CF61F0C24346F75CBB259871A7962D0AF85780F0441B5ED6E477EEDE3EE8458700
                                Function 00007FFDFAF7F160 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 487COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
                                • API String ID: 1776107623-554953066
                                • Opcode ID: 9a62253b59d75b062b5d8a2c7842bff6b3b59b05ab2fdc856a70bbc8fcb750df
                                • Instruction ID: f61b4285a99dc5ced0aa3b51df1ed9cb2d74c8535f7bc9a48e2dafec6885dc5f
                                • Opcode Fuzzy Hash: 9a62253b59d75b062b5d8a2c7842bff6b3b59b05ab2fdc856a70bbc8fcb750df
                                • Instruction Fuzzy Hash: 8932BD72B0878186EB68CF25E460ABC37A4FF45BA4F404276EA6D4B798DF38E451C710
                                Function 00007FFDFAF4F070 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: new[]
                                • String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
                                • API String ID: 4059295235-3840279414
                                • Opcode ID: b101e88f1affa16b041cfc1e2f1eca4e78ffadcba296a8941160182071edcd3a
                                • Instruction ID: 455fd76d28fb28cfecd82d9bafeab3e691c25870d3fbdda759eca86f3b15feb6
                                • Opcode Fuzzy Hash: b101e88f1affa16b041cfc1e2f1eca4e78ffadcba296a8941160182071edcd3a
                                • Instruction Fuzzy Hash: 49512612F0D28344FB19AB61E821E756791AF85FB8F480271FD6D0B6DADE3CEA418310
                                Function 00007FFDFB0C41D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLastsetsockopt
                                • String ID: ..\s\crypto\bio\b_sock2.c$o
                                • API String ID: 1729277954-1872632005
                                • Opcode ID: 55b9dc58d84091389097999520ee8ef412c939128f98883080a21d6a8e2db22d
                                • Instruction ID: 2f18789a2ae9219c61d614ea4a27693a3aadc647689c46f970064c428ac4938d
                                • Opcode Fuzzy Hash: 55b9dc58d84091389097999520ee8ef412c939128f98883080a21d6a8e2db22d
                                • Instruction Fuzzy Hash: E2519E62B1A54387E720DB21E824ABD7360FB82748F544235EAAD03AEDCF3DE545DB40
                                Function 00007FFDFB0C23D3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94libraryloaderCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
                                • String ID: Service-0x$_OPENSSL_isservice
                                • API String ID: 1944374717-1672312481
                                • Opcode ID: bc225b995bbff2d3b119e7081b5c779a5c3234c2f77d3222796a288c2c9d01dd
                                • Instruction ID: b5c0ec8e656080bb49d09a2276b21c2f9695e88b9b95b2a100962db270d0a169
                                • Opcode Fuzzy Hash: bc225b995bbff2d3b119e7081b5c779a5c3234c2f77d3222796a288c2c9d01dd
                                • Instruction Fuzzy Hash: 73416262B0AB8786EB509F24D861AB92390EF497B8B484735E97D477F9DF3CE5058300
                                Function 00007FFDFB0C60CD Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: Fiber$Switch$CreateDelete
                                • String ID: *$..\s\crypto\async\async.c
                                • API String ID: 2050058302-1471988776
                                • Opcode ID: c719461031cd02e8d3460bfb015ac940308ff04098e5674ea97173e8f31946a0
                                • Instruction ID: b56e4e1c3034899d5cfc42b229a33fa8f167074f0f57291d55c75fb1cc2e8b48
                                • Opcode Fuzzy Hash: c719461031cd02e8d3460bfb015ac940308ff04098e5674ea97173e8f31946a0
                                • Instruction Fuzzy Hash: E9A17F72B0AA4386EB20DF15E460A7963A0BB45B88F588431EAAD477F9DF3CE545D700
                                Function 00007FFDFB0C3779 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007B5630
                                • String ID: MASK:$default$nombstr$pkix$utf8only
                                • API String ID: 2248877218-3483942737
                                • Opcode ID: 56a8b705b4d859711014d430f94cbbc3222095bc84f144be5c70752352c183a7
                                • Instruction ID: a66ce8fdf330311db216f11e2a1263a33e53c3b00c71f8759e1285742aafdf54
                                • Opcode Fuzzy Hash: 56a8b705b4d859711014d430f94cbbc3222095bc84f144be5c70752352c183a7
                                • Instruction Fuzzy Hash: 7B314A23F1E5838BEB415B18E460BB93790EB49794F445132EB6E436F9EE2CE491C700
                                Function 00007FFDFAF65150 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 311COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 1776107623-481979681
                                • Opcode ID: 84c27e4c2749e9f505d00220f28ed30d545ba1ce016b3ff8357f52d0c83b85b1
                                • Instruction ID: 3a9f73686e17ca23b4bf487ef3d1ace355b0d5e31c4150e7ecc65f5560276c77
                                • Opcode Fuzzy Hash: 84c27e4c2749e9f505d00220f28ed30d545ba1ce016b3ff8357f52d0c83b85b1
                                • Instruction Fuzzy Hash: 48D1CC7270878286D768CF25E024AA977A9FF88BA8F154176EE5D4B798DF39D841C300
                                Function 00007FFDFB0C158C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 131COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E14631170
                                • String ID: ..\s\crypto\x509v3\v3_utl.c$E$FALSE$TRUE
                                • API String ID: 2775844594-1433594941
                                • Opcode ID: 04e22798ec487ff3aa34a088d2b38383e963ba2359178234cc0d99ed44e9a228
                                • Instruction ID: e636b6f03200873f36e6eabdac4792def20e239ad07c3467df8e8a4f0445bdaf
                                • Opcode Fuzzy Hash: 04e22798ec487ff3aa34a088d2b38383e963ba2359178234cc0d99ed44e9a228
                                • Instruction Fuzzy Hash: EF519B61B8BA4386EB14EB519470BB823E0AF45784F885434EDAD47BEEDF3CE6418300
                                Function 00007FFDFAFA1850 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 329COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                • foreign key on %s should reference only one column of table %T, xrefs: 00007FFDFAFA18D5
                                • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFDFAFA18FE
                                • unknown column "%s" in foreign key definition, xrefs: 00007FFDFAFA1BEC
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                • API String ID: 1776107623-272990098
                                • Opcode ID: 1c355eb9446cff6f822322527a86fcfd9949d33051e4918b10a73cc2629c8281
                                • Instruction ID: 9a9389ec9734f9978e1d85421d888821ad2db35d8a1b7475951138bd34fa2572
                                • Opcode Fuzzy Hash: 1c355eb9446cff6f822322527a86fcfd9949d33051e4918b10a73cc2629c8281
                                • Instruction Fuzzy Hash: D7D1C262F0978281EB288B159064AB977A1FF85BE4F0642B5EEAD0F7D9DE3CD441C304
                                Function 00007FFDFAF94450 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 302COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: "%w" $%Q%s
                                • API String ID: 1776107623-1987291987
                                • Opcode ID: d8d8e109483670c4cff443289ac888ee3e835be99f50561d44341cd267616109
                                • Instruction ID: eb26528ea21ba437bbdf7f68451e5bc6b599fb7963638d579427bfb4695de758
                                • Opcode Fuzzy Hash: d8d8e109483670c4cff443289ac888ee3e835be99f50561d44341cd267616109
                                • Instruction Fuzzy Hash: D2C1C461B09A8285EB18DF15A860A796791FF5ABA9F544375EE7E0B7D8DF3CE400C300
                                Function 00007FFDFAFC35C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %.*z:%u$column%d$rowid
                                • API String ID: 1776107623-2903559916
                                • Opcode ID: addee16be27ba12a2e9a3c901d93d62b0e89119f9c027a5b1171d251488e692e
                                • Instruction ID: 7b8d3560a4918a7273b8103701b99326a73f4a19a5026747a9a54d383f54267d
                                • Opcode Fuzzy Hash: addee16be27ba12a2e9a3c901d93d62b0e89119f9c027a5b1171d251488e692e
                                • Instruction Fuzzy Hash: CBB1B562B0969242EB699B169420E79A791EF41BE4F4A4375EE6D0F7C9DF3CE601C300
                                Function 00007FFDFAF5ECC0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 270COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 0-481979681
                                • Opcode ID: 782611c81ddf8bf212e515f4a750447ce47c21e2b716e242f0c6ec6302aff568
                                • Instruction ID: 60fe9bfd31a61d4b1238cf1378419df3843431fc5c0836472f56f5a4bcbd0ff7
                                • Opcode Fuzzy Hash: 782611c81ddf8bf212e515f4a750447ce47c21e2b716e242f0c6ec6302aff568
                                • Instruction Fuzzy Hash: 44B1F622B0C2D14AD7288B15D4A0A7EBBA2FF81794F044275EB9B4B7C9CE3CE955D710
                                Function 00007FFDFAF63270 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 260COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 1776107623-481979681
                                • Opcode ID: 069fffe95d4fc24e2ab5e0d4fadc81e916aad1032b61017090729a1139b25d08
                                • Instruction ID: e2ba30cc533db65b9c176e302b72e520f6b4d8b7e83dd9753c083d4d86eef328
                                • Opcode Fuzzy Hash: 069fffe95d4fc24e2ab5e0d4fadc81e916aad1032b61017090729a1139b25d08
                                • Instruction Fuzzy Hash: 16B1C032B0869687E768CB16A064F7AB7A4FF44794F014275EE5D4BB89DF39E840C700
                                Function 00007FFDFAF4D250 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 256COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s-shm$readonly_shm$winOpenShm
                                • API String ID: 1776107623-2815843928
                                • Opcode ID: 625f219681cb963a81eed21fe677e17c746c28b803c4722ea517b21750a01de8
                                • Instruction ID: 2c6177fd7282c48dc3e92f3f860e1f33bab3879bab96d381fcece97d25eb8dd1
                                • Opcode Fuzzy Hash: 625f219681cb963a81eed21fe677e17c746c28b803c4722ea517b21750a01de8
                                • Instruction Fuzzy Hash: 5DC12D21B0AB4386FB689B61E460E793360BF46B68F444275EE6E477E8DF3CE5459300
                                Function 00007FFDFAF665D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 244COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 0-481979681
                                • Opcode ID: 15e0f3433fb5b3e08eddd5557e9703fcd33e106e159bed805e8690dbf31db93a
                                • Instruction ID: 54e2d8c451d32fce093666d0c146bc531718590bbe152791acaf4bb6586ba66e
                                • Opcode Fuzzy Hash: 15e0f3433fb5b3e08eddd5557e9703fcd33e106e159bed805e8690dbf31db93a
                                • Instruction Fuzzy Hash: 56914522B0C1E246D3AC9B26A160CBD7E91EB50354F0443B6EEEA4B7C9DE2DE554DB10
                                Function 00007FFDFAF934F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 215COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                • API String ID: 1776107623-2063813899
                                • Opcode ID: eaa7cd8bef1883cd6141f69f537d598f30ad47c29c4a0dc6b25f57603f70d3a3
                                • Instruction ID: da1e173fa6c596fcbc468ae146a055e022c5165d422b048c93f0127a2bc896bc
                                • Opcode Fuzzy Hash: eaa7cd8bef1883cd6141f69f537d598f30ad47c29c4a0dc6b25f57603f70d3a3
                                • Instruction Fuzzy Hash: 6791D266B09B8283EB14CF019464AB977A5FF49B94F458379EE6D0B799DF38E040C700
                                Function 00007FFDFAF5F220 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 1776107623-481979681
                                • Opcode ID: bb331690382cd9aba51fbf9192c4a8343009a09fab82c0642137ec25885589cc
                                • Instruction ID: b863b456021af3ebe3483ad1b1960e2099e4781a01c37b905a63d77e3c3f9351
                                • Opcode Fuzzy Hash: bb331690382cd9aba51fbf9192c4a8343009a09fab82c0642137ec25885589cc
                                • Instruction Fuzzy Hash: 6A715A22A0C1E24AE32D9625E0A08BDBE91DB51325B5483F2FFF64B6C9CD2CE545D760
                                Function 00007FFDFAE21FC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726484532.00007FFDFAE21000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FFDFAE20000, based on PE: true
                                • Associated: 00000001.00000002.1726465722.00007FFDFAE20000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAE84000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAED3000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF2C000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF31000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726484532.00007FFDFAF34000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726661849.00007FFDFAF35000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                • Associated: 00000001.00000002.1726679942.00007FFDFAF37000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfae20000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007B6570
                                • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                • API String ID: 4069847057-87138338
                                • Opcode ID: dd12be397e2784a3b9b42d5ec1b23b2ed281038ba6f510f7d5b8d27382faff68
                                • Instruction ID: 7b1cb2b6770bd308d0375287859e302753c74928130b340016d190c310ad9d95
                                • Opcode Fuzzy Hash: dd12be397e2784a3b9b42d5ec1b23b2ed281038ba6f510f7d5b8d27382faff68
                                • Instruction Fuzzy Hash: 2461F832F1864246E768AA19A420EBA72D2FB90790F444275EE7F47ADDEF7DD405CB00
                                Function 00007FFDFAF58670 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 0-481979681
                                • Opcode ID: f99b0b572c4dd53c2481063b49c418f8dd713a95c4d3cec2ed11dc8c8c6a5ea2
                                • Instruction ID: 4d73d4d80272f23356c00e159fa94b70886597f7dc727a21a2a74dedec32d264
                                • Opcode Fuzzy Hash: f99b0b572c4dd53c2481063b49c418f8dd713a95c4d3cec2ed11dc8c8c6a5ea2
                                • Instruction Fuzzy Hash: 07718322B1C64289FB688B11E460B7967A1FF44B94F144275EE6D0B7E9DF3CF4419380
                                Function 00007FFDFAF588F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 1776107623-481979681
                                • Opcode ID: e46cf6a756d8e439f7bf39b0c578f90e143a7744ae175120d6a15517b8f2a346
                                • Instruction ID: c557319b381411fc50e97ae532a8259d16f3685c7cb16601c1365d24f95647d5
                                • Opcode Fuzzy Hash: e46cf6a756d8e439f7bf39b0c578f90e143a7744ae175120d6a15517b8f2a346
                                • Instruction Fuzzy Hash: 4A51DF32718B829AEB58CF26D460AA973A4FF48B94F044172EF6D47798DF38E450D380
                                Function 00007FFDFB0C2833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: ..\s\crypto\async\async.c$T
                                • API String ID: 0-2182492907
                                • Opcode ID: ced47efd6854a0b1ee8219945b029c3d75fc0d777b4b3386fd7b97e9d7cf6361
                                • Instruction ID: ccb24121ab47f38c26f25e04d4ef1cbd033e8e3f076b1c820b00d51ca530e829
                                • Opcode Fuzzy Hash: ced47efd6854a0b1ee8219945b029c3d75fc0d777b4b3386fd7b97e9d7cf6361
                                • Instruction Fuzzy Hash: DB517F32B0BA4392E720EB11E4209B96761FF45B88F484435EA6D07BEDDF3DE5099B00
                                Function 00007FFDFB186D50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129networkCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: getnameinfohtons
                                • String ID: $..\s\crypto\bio\b_addr.c
                                • API String ID: 1503050688-1606403076
                                • Opcode ID: 5625fd2cd7728f7219475ff4565046832ace99646516da0e608f003e7bc6e737
                                • Instruction ID: d69866f485026d4d6a90f9d2fbcb10998102f0f26b19f3d3b93ef0bdc07d2ba2
                                • Opcode Fuzzy Hash: 5625fd2cd7728f7219475ff4565046832ace99646516da0e608f003e7bc6e737
                                • Instruction Fuzzy Hash: D951C362F1AA4386FB209B11D960AB973A0FF41748F448135EBAD476EDEF3DE4458700
                                Function 00007FFDFAF5A600 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
                                • API String ID: 1776107623-481979681
                                • Opcode ID: b2bd962ca4d533c51114e8662621ced1fd23e52fad8a1fcbe5e1e3e5f6701a96
                                • Instruction ID: b302ff5a0e6cd2e1cc2e091b6589e0c7b6344b8ea8bea1aa19625618456a5a8a
                                • Opcode Fuzzy Hash: b2bd962ca4d533c51114e8662621ced1fd23e52fad8a1fcbe5e1e3e5f6701a96
                                • Instruction Fuzzy Hash: 2241C122B2CB468AE764AF15E464AA973A4FF84BA0F540235FE5D0B7D8DF3CD8518740
                                Function 00007FFDFB0C3841 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON
                                Download Yara Rule
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID:
                                • String ID: ..\s\crypto\bio\b_sock.c$J$host=
                                • API String ID: 0-1729655730
                                • Opcode ID: 31c7aae0c6204fcaae541c015ea13e20bcfa82d779c5bb0f8b846d03ff15bf19
                                • Instruction ID: b24b6258fcc4ec241e720e4a16dd8d663d052ca498ebfc8846f16ce6e17e4b92
                                • Opcode Fuzzy Hash: 31c7aae0c6204fcaae541c015ea13e20bcfa82d779c5bb0f8b846d03ff15bf19
                                • Instruction Fuzzy Hash: 49319D72B0958382EB109B55F4619BEA360FB86788F440135EBAC43BEEDF3DD5458B00
                                Function 00007FFDFB0C1C76 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007B5630
                                • String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
                                • API String ID: 2248877218-3633731555
                                • Opcode ID: ea9dbb28cfd143c8dfcb19cf07e193ff5b0562c8a9ccb7e415cce9e69b2824d1
                                • Instruction ID: 9111c505ae6bd5022ba42ae83ab3e689a36470806d931280e6bed7fb4d9dfc43
                                • Opcode Fuzzy Hash: ea9dbb28cfd143c8dfcb19cf07e193ff5b0562c8a9ccb7e415cce9e69b2824d1
                                • Instruction Fuzzy Hash: D1219161B0EA8382EF20DB55F4209A9A3A0FB85794F604031EA9C43BEDDF7DE144DB00
                                Function 00007FFDFB0C139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLastsocket
                                • String ID: ..\s\crypto\bio\b_sock2.c$2
                                • API String ID: 1120909799-2051290508
                                • Opcode ID: 2ef5472a3713315c0ebdeb3789e1964bedc6f77517e54092a2e54a431cd722de
                                • Instruction ID: 5a6f8f021c501f8520a02d72af793d57f87244ab8987f819cd6d4c80bead0787
                                • Opcode Fuzzy Hash: 2ef5472a3713315c0ebdeb3789e1964bedc6f77517e54092a2e54a431cd722de
                                • Instruction Fuzzy Hash: 16018B72F1A55383E3109B25E4209AD6264BB82758F604235E67D43AEDCF3DE9468B40
                                Function 00007FFDFB0C2DEC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLast
                                • String ID: Operation not permitted$unknown
                                • API String ID: 1452528299-31098287
                                • Opcode ID: 98fd99213be571fb8821e332285a7a3172dfad59924788fedf6360fac81b26b1
                                • Instruction ID: dc469d405f2e78207dd88a3bfdda9d22126f5686f5c93fa5564b9ebc0cd38a04
                                • Opcode Fuzzy Hash: 98fd99213be571fb8821e332285a7a3172dfad59924788fedf6360fac81b26b1
                                • Instruction Fuzzy Hash: DF813661B4A65386FB50AB50E875BB923A0FB86B84F840032D96E876FDDF3CE455C700
                                Function 00007FFDFAFE6630 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 382COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: %s.xBestIndex malfunction
                                • API String ID: 1776107623-3856629991
                                • Opcode ID: eb63e3c6b4dea9960043a8abc5a7aa58b04cc13933313bbf261c8a8e2dab8fb5
                                • Instruction ID: 188681daf1776f43f5c0e1e2f1f0c4fef91a94cd64d780e11319cc37c7ef4d3a
                                • Opcode Fuzzy Hash: eb63e3c6b4dea9960043a8abc5a7aa58b04cc13933313bbf261c8a8e2dab8fb5
                                • Instruction Fuzzy Hash: F702A672B0974686EB988F25D4A0A7837A1FF45B94F044675DA6D477E8CF3CE8A0D700
                                Function 00007FFDFAFE4290 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 365COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: BINARY$out of memory
                                • API String ID: 1776107623-3971123528
                                • Opcode ID: 1799d1d9a8c80a14ad7925e8d4d29a046007d3c9d19382aa409d76e507f2d946
                                • Instruction ID: 6f9d1221f99e36b66b982b1601bc5d4f108ade4ea1ea82ec96cf2aeae44ee1b2
                                • Opcode Fuzzy Hash: 1799d1d9a8c80a14ad7925e8d4d29a046007d3c9d19382aa409d76e507f2d946
                                • Instruction Fuzzy Hash: ABF11372B0868786E7288F15D090A7977A1FF44B95F44827AEAAD4B7D8DF3ED841C700
                                Function 00007FFDFAF75EC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007B5630
                                • String ID: ValueList$p
                                • API String ID: 2248877218-635946892
                                • Opcode ID: ec54ab2dcaf1dbcc276f08fffb0a91cf1cefc7b65af78ff2562e2f8050cd1ace
                                • Instruction ID: 05893d9f42b5d7cf142a327708155a38bf87ef58ea00323f5c5738c31ac7f835
                                • Opcode Fuzzy Hash: ec54ab2dcaf1dbcc276f08fffb0a91cf1cefc7b65af78ff2562e2f8050cd1ace
                                • Instruction Fuzzy Hash: 1C61C522B0C78286EBA8DB25A1609B963A1FF55790F444275FF994B7DADF3CE851C300
                                Function 00007FFDFB0C2743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007
                                • String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
                                • API String ID: 3568877910-2648760357
                                • Opcode ID: 2a3bc1689ddc0f887af3b9ff0742d7664fa732a47decfc4233859a34b1d629f8
                                • Instruction ID: 50330087b0c24aa2ad37f4eb74882890153a6b3d0384dbec3e67df2013ee7ef1
                                • Opcode Fuzzy Hash: 2a3bc1689ddc0f887af3b9ff0742d7664fa732a47decfc4233859a34b1d629f8
                                • Instruction Fuzzy Hash: D2518F72F196828AE760DF19E450A6AB7A1FB99744F045131EA9D87BA9DF3CE4408B00
                                Function 00007FFDFB0C1613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: getaddrinfo
                                • String ID: ..\s\crypto\bio\b_addr.c
                                • API String ID: 300660673-2547254400
                                • Opcode ID: a0b5319feac94952a1432a4b762969270d9d630226e0b1293bfa37404cbb0f4b
                                • Instruction ID: 08b596f01f0aea2af9e48a82e20578545dcb9084cea614d0e56ce3219df1f698
                                • Opcode Fuzzy Hash: a0b5319feac94952a1432a4b762969270d9d630226e0b1293bfa37404cbb0f4b
                                • Instruction Fuzzy Hash: 4241C272F19A8387E7509B12A860ABE7390FB85748F104135FA9E43BE9DF3CD8458B40
                                Function 00007FFDFAF4C000 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: delayed %dms for lock/sharing conflict at line %d$winRead
                                • API String ID: 1776107623-1843600136
                                • Opcode ID: c42462ee678e96c825723e9381acb87a1b22cd2c90639cf46ca189585d33ef91
                                • Instruction ID: 79a329310c3235ea853a88ac9d7743b4592d81d3047165d71e714e7e148b1e39
                                • Opcode Fuzzy Hash: c42462ee678e96c825723e9381acb87a1b22cd2c90639cf46ca189585d33ef91
                                • Instruction Fuzzy Hash: 82410432B09A0346E3149F29E850DA97765FF85B94F445232EE6D877E8DF3CEA468340
                                Function 00007FFDFAF9DBC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726716991.00007FFDFAF41000.00000040.00000001.01000000.00000019.sdmp, Offset: 00007FFDFAF40000, based on PE: true
                                • Associated: 00000001.00000002.1726698067.00007FFDFAF40000.00000002.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB093000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB095000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726716991.00007FFDFB0AA000.00000040.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726870011.00007FFDFB0AC000.00000080.00000001.01000000.00000019.sdmpDownload File
                                • Associated: 00000001.00000002.1726888688.00007FFDFB0AE000.00000004.00000001.01000000.00000019.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfaf40000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E146319
                                • String ID: cannot use RETURNING in a trigger$sqlite_returning
                                • API String ID: 1776107623-753984552
                                • Opcode ID: f5230fc9e4cf321162a8627f211f83dfe1f344e37eb606a3a44f2b7169fa9843
                                • Instruction ID: a5cbf1ddb8d6a365a84400b60d6ec5b1bec1d6f4d1f822b5391f36a80b289fc9
                                • Opcode Fuzzy Hash: f5230fc9e4cf321162a8627f211f83dfe1f344e37eb606a3a44f2b7169fa9843
                                • Instruction Fuzzy Hash: 5F416031B09B4286E76C9B11E560BB973A0FF49B94F544271EBAE0B7D9CF68E451C300
                                Function 00007FFDFB0C39B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: 00007E2002
                                • String ID: ..\s\crypto\rand\randfile.c$Filename=
                                • API String ID: 1750240854-2201148535
                                • Opcode ID: 6b3b0f7a3795f012e9ff1fc1ebc767fdf81fc92d56402ad81cac52365df12dad
                                • Instruction ID: c6554591b3dd516db30bee98ec1b9ee4a2c0f3d45a4ba099ca387b8cdc1ab64d
                                • Opcode Fuzzy Hash: 6b3b0f7a3795f012e9ff1fc1ebc767fdf81fc92d56402ad81cac52365df12dad
                                • Instruction Fuzzy Hash: B5316CA1B0AA4782EB20AB55E464AB963A0FB45788F404136DA6D476E9EF3CE508C705
                                Function 00007FFDFB0C3387 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLastgetsockname
                                • String ID: ..\s\crypto\bio\b_sock.c
                                • API String ID: 566540725-540685895
                                • Opcode ID: a7a9d23270d94e37348a85efb9068d8d5f36d2912cc69f144dbe1a5ed76ec5ab
                                • Instruction ID: f0166eac873558f8ae81d2a81412e7e80b7e02082c9087882707f6fde9d2bc57
                                • Opcode Fuzzy Hash: a7a9d23270d94e37348a85efb9068d8d5f36d2912cc69f144dbe1a5ed76ec5ab
                                • Instruction Fuzzy Hash: 6C217FB2F4550786E710DB60E815AEE6760FB81309F904135E66C026F9DF3DE589DB40
                                Function 00007FFDFB0C6BE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON
                                Download Yara Rule
                                APIs
                                Strings
                                Memory Dump Source
                                • Source File: 00000001.00000002.1726926360.00007FFDFB0C1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFDFB0C0000, based on PE: true
                                • Associated: 00000001.00000002.1726907514.00007FFDFB0C0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB0CD000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB125000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB139000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB149000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB15D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30C000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB30E000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB339000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB36A000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB390000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3DE000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E4000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB3E6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB402000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1726926360.00007FFDFB40F000.00000040.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727411729.00007FFDFB413000.00000080.00000001.01000000.00000014.sdmpDownload File
                                • Associated: 00000001.00000002.1727429814.00007FFDFB414000.00000004.00000001.01000000.00000014.sdmpDownload File
                                Joe Sandbox IDA Plugin
                                • Snapshot File: hcaresult_1_2_7ffdfb0c0000_Colby Dupe Script.jbxd
                                Similarity
                                • API ID: ErrorLastioctlsocket
                                • String ID: ..\s\crypto\bio\b_sock.c
                                • API String ID: 1021210092-540685895
                                • Opcode ID: 4b3498a1bc9275628b4fed3f0116b26741c55f820a8da06fdf06bba4b20f0e59
                                • Instruction ID: 61d8e436d252d507d086eb86e58a7d97e78905ca672e627975e5cc589c83c5b0
                                • Opcode Fuzzy Hash: 4b3498a1bc9275628b4fed3f0116b26741c55f820a8da06fdf06bba4b20f0e59
                                • Instruction Fuzzy Hash: B0E09AA1F2B91347F3106BA0D824FBA2250BF4534DF004230E97D826F9DF3DE2498A00